Edit tour

Windows Analysis Report
OqAVRCkQ3T.exe

Overview

General Information

Sample name:	OqAVRCkQ3T.exe renamed because original name is a hash value
Original sample name:	649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9.exe
Analysis ID:	1524835
MD5:	6d6a207d5513fa5ac6ead647f5d66a6a
SHA1:	913e0d1aadbc1593b76f6442bb89070bc4a5e224
SHA256:	649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9
Tags:	AciraConsultingIncexeuser-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Yara detected LummaC Stealer

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

LummaC encrypted strings found

Maps a DLL or memory area into another process

Modifies the DNS server

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Queries sensitive system registry key value via command line tool

Reads the Security eventlog

Reads the System eventlog

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Uses cmd line tools excessively to alter registry or file data

Writes to foreign memory regions

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries device information via Setup API

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Tap Installer Execution

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

OqAVRCkQ3T.exe (PID: 6184 cmdline: "C:\Users\user\Desktop\OqAVRCkQ3T.exe" MD5: 6D6A207D5513FA5AC6EAD647F5D66A6A)

OqAVRCkQ3T.tmp (PID: 5664 cmdline: "C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp" /SL5="$20440,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe" MD5: 259E3EE4646FC251C3513EEF2683479F)

ComDebug.exe (PID: 7156 cmdline: "C:\Program Files\FastestVPN\Resources\ComDebug.exe" MD5: F892887D8532D19F74884CDC48B1AC8B)

more.com (PID: 3772 cmdline: C:\Windows\SysWOW64\more.com MD5: 03805AE7E8CBC07840108F5C80CF4973)

conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SearchIndexer.exe (PID: 4820 cmdline: C:\Windows\SysWOW64\SearchIndexer.exe MD5: CF7BEFBA5E20F2F4C7851D016067B89C)

WerFault.exe (PID: 4476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 384 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 3788 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7064 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

find.exe (PID: 1576 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3116 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tapinstall.exe (PID: 6532 cmdline: tapinstall.exe remove tap0901 MD5: E313336C82EB265542664CC7A360C5FF)

tapinstall.exe (PID: 5312 cmdline: tapinstall.exe install OemVista.inf tap0901 MD5: E313336C82EB265542664CC7A360C5FF)

cmd.exe (PID: 3348 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5956 cmdline: sc stop fastestvpndriver MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 1248 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

find.exe (PID: 2460 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

reg.exe (PID: 7116 cmdline: reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

find.exe (PID: 7060 cmdline: find /i "Windows 7" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

xcopy.exe (PID: 5548 cmdline: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

nfregdrv.exe (PID: 6676 cmdline: release\nfregdrv.exe -u fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)

nfregdrv.exe (PID: 5552 cmdline: release\nfregdrv.exe fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)

sc.exe (PID: 5600 cmdline: "C:\Windows\system32\sc.exe" stop FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FastestVPN.WindowsService.exe (PID: 7136 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)

WerFault.exe (PID: 7044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 1076 MD5: C31336C1EFC2CCB44B4326EA793040F2)

sc.exe (PID: 3376 cmdline: "C:\Windows\system32\sc.exe" delete FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FastestVPN.WindowsService.exe (PID: 6404 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)

subinacl.exe (PID: 6504 cmdline: "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO MD5: 4798226EE22C513302EE57D3AA94398B)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6052 cmdline: "C:\Windows\system32\sc.exe" start FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5608 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 2292 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 1020 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000158" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 6660 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

FastestVPN.exe (PID: 3292 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)

powershell.exe (PID: 3792 cmdline: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4456 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7080 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7136 -ip 7136 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 760 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4820 -ip 4820 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4612 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["affecthorsedpo.shop", "bargainnykwo.shop", "publicitttyps.shop", "radiationnopp.shop", "bannngwko.shop", "bouncedgowp.shop", "benchillppwo.shop", "scatterdshsadyi.shop", "answerrsdo.shop"], "Build id": "long--try"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp, ProcessId: 5664, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3348, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, ProcessId: 5548, ProcessName: xcopy.exe

Sigma detected: Tap Installer Execution

Source: Process started

Author: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: tapinstall.exe remove tap0901, CommandLine: tapinstall.exe remove tap0901, CommandLine|base64offset|contains: , Image: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, NewProcessName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, OriginalFileName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3788, ParentProcessName: cmd.exe, ProcessCommandLine: tapinstall.exe remove tap0901, ProcessId: 6532, ProcessName: tapinstall.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun, ParentImage: C:\Program Files\FastestVPN\FastestVPN.exe, ParentProcessId: 3292, ParentProcessName: FastestVPN.exe, ProcessCommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, ProcessId: 3792, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 5608, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: SearchIndexer.exe.4820.43.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["affecthorsedpo.shop", "bargainnykwo.shop", "publicitttyps.shop", "radiationnopp.shop", "bannngwko.shop", "bouncedgowp.shop", "benchillppwo.shop", "scatterdshsadyi.shop", "answerrsdo.shop"], "Build id": "long--try"}

Multi AV Scanner detection for domain / URL

Source: benchillppwo.shop

Virustotal: Detection: 21%

Perma Link

Sample uses string decryption to hide its real strings

Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: benchillppwo.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: publicitttyps.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: answerrsdo.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: radiationnopp.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: affecthorsedpo.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: bargainnykwo.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: bannngwko.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: bouncedgowp.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: scatterdshsadyi.shop
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000002B.00000002.2742797142.0000000000EFD000.00000002.00000001.01000000.00000000.sdmp	String decryptor: jMw1IE--VPN

Source: OqAVRCkQ3T.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-F31HU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-8SCCE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-3QH42.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-29PQI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-6P2C9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-BT6B4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-IN04I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-FP6VU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-EEEM3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-H0O73.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-LEV7B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-O6V0U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-TJLQ2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-JS6M2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-CPTP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-7D6TA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-G38N1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-RAUHQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-TIJQU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-QAEOR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-6HFVM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-HT2O2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-OV817.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-EAFR9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-GP1QP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-FMQAJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-SELKR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-6OAGB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-7KO33.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-HGUF4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-IQIIH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-O947P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-3M67B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-0A8FD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-7ULB1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-HG5LC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-69FAA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-KPVP8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-8KR34.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-0BOGR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-ILS2N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-AJ7UA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-G6DJI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-RR5LV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-SBGRB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-U9EKE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-D2992.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-1DJ4G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-OE3IT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-Q5PL9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-E834D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-TQ205.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-7CHS6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-STKUM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-IOEQA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-0GCGM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-KLMTU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-DQ0IA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-SQ4JH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-1J41S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-HQ1IR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-PVULV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-I47CR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-9AF3F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QAA9O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-UA1JD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QTAN0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-H0796.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-M395B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-92POB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-OVOMN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-SKNAP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-NMBSC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-7G3MI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-OIO4P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-KSP41.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-RVBPK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PVM3P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-48IDT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-GOJKM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ON3RQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-J4FPP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DHPIR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6JP0F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FJ6LN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-CL5M9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3LE8C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3U4F4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-32KE2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-5RGR2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-PU5N8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-JDOCE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-INGVK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-74SDR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-7CFS6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-0PS85.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CDPP5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-E3JOD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GTT7V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-HUQLV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-7URTB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-DHG8F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-NP4VA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-KQVDN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-AIA31.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-L37FQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-DFAQV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-9KLB3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-NRIKT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-RSP45.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-N257N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-OP4DR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-TKLHN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-HMSV9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-GV36A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-C4FPO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-G5QC8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-25GUT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-CVIBF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-B2JMI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-KA6B7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-TF74Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-BU4VV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-0P3G0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-T1I9D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-25JMN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-SGO0H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-SA7LQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-9V0LH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-BEQUD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-GNOTT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-20RRP.tmp	Jump to behavior
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1

Jump to behavior

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

Source: OqAVRCkQ3T.exe

Static PE information: certificate valid

Source: OqAVRCkQ3T.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr
Source:	Binary string: E:\A\_work\500\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: is-69FAA.tmp.2.dr
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000B.00000000.2457382058.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000C.00000002.2532589822.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000C.00000000.2462265454.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, is-ON3RQ.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdb4 source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdb source: is-EAFR9.tmp.2.dr
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: is-SA7LQ.tmp.2.dr
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2767595544.0000000004EE2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdb* source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, is-3M67B.tmp.2.dr
Source:	Binary string: indows\FastestVPN.WindowsService.pdbpdbice.pdbdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 0000000D.00000002.2675419337.0000000004610000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2675138446.00000000042B5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743176963.0000000004CD5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743459476.0000000005140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3359514963.0000000005932000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb13 source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, subinacl.exe, 00000031.00000000.2806088673.0000000001001000.00000020.00000001.01000000.00000037.sdmp, subinacl.exe, 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3357098503.0000000005872000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3355343741.00000000053D2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdbes source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: is-SA7LQ.tmp.2.dr
Source:	Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3319377426.0000000002C22000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3357302797.0000000005882000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: is-CVIBF.tmp.2.dr
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.PDBE source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, is-3M67B.tmp.2.dr
Source:	Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdbW source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, 00000031.00000000.2806088673.0000000001001000.00000020.00000001.01000000.00000037.sdmp, subinacl.exe, 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3376197070.0000000006122000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3376197070.0000000006122000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358045747.00000000058A2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358329842.00000000058B2000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, nfregdrv.exe, 00000020.00000002.2554138371.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, is-DFAQV.tmp.2.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, nfregdrv.exe, 00000020.00000002.2554138371.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, is-DFAQV.tmp.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3357098503.0000000005872000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3376379672.0000000006132000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 0000001F.00000000.2548428166.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000002.2551051706.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000000.2550595786.0000000000408000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 0000001D.00000002.3404635413.000000000BD82000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdb source: is-CVIBF.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3320152253.0000000002C52000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3376379672.0000000006132000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbs source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\ServerL source: FastestVPN.exe, 0000001D.00000002.3381816238.0000000008931000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3357302797.0000000005882000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: @&n.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3319377426.0000000002C22000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3370837677.0000000005E82000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdbSHA256 source: is-EAFR9.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3359514963.0000000005932000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3404635413.000000000BD82000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.exe, 0000001D.00000002.3355343741.00000000053D2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 0000000D.00000002.2675419337.0000000004610000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2675138446.00000000042B5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743176963.0000000004CD5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743459476.0000000005140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 0000001F.00000000.2548428166.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000002.2551051706.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000000.2550595786.0000000000408000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: is-AJ7UA.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 0000001D.00000000.2537268642.000000000076D000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2767595544.0000000004EE2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3359770945.0000000005942000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3320296929.0000000002C62000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000000.2557472879.00000000005F2000.00000002.00000001.01000000.00000020.sdmp, is-RSP45.tmp.2.dr
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^\|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3320152253.0000000002C52000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: mscorlib.pdb source: FastestVPN.exe, 0000001D.00000002.3309559147.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000011.00000003.2491247191.000002C9303BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsj\nfsdk2_1.6\driver_wfp\std\objfre_win7_amd64\amd64\netfilter2.pdb source: is-NP4VA.tmp.2.dr
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3320296929.0000000002C62000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3370837677.0000000005E82000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: H:\Projects\NetFilter SDK\iphelperclose\Release\iphelperclose.pdb source: is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr
Source:	Binary string: E:\A\_work\500\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb? source: is-69FAA.tmp.2.dr
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0ECAC FindFirstFileExW,FindNextFileW,FindClose,	11_2_00007FF6CBA0ECAC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	11_2_00007FF6CBA0E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E810 FindFirstFileExW,	11_2_00007FF6CBA0E810
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	11_2_00007FF6CBA0E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	11_2_00007FF6CB9D3630
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,	49_2_0103172D
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,	49_2_01031DDF

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,

31_2_100163B0

Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: affecthorsedpo.shop
Source: Malware configuration extractor	URLs: bargainnykwo.shop
Source: Malware configuration extractor	URLs: publicitttyps.shop
Source: Malware configuration extractor	URLs: radiationnopp.shop
Source: Malware configuration extractor	URLs: bannngwko.shop
Source: Malware configuration extractor	URLs: bouncedgowp.shop
Source: Malware configuration extractor	URLs: benchillppwo.shop
Source: Malware configuration extractor	URLs: scatterdshsadyi.shop
Source: Malware configuration extractor	URLs: answerrsdo.shop

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: is-KQVDN.tmp.2.dr	Static PE information: Found NDIS imports: FwpsFreeNetBufferList0, FwpmEngineOpen0, FwpmProviderAdd0, FwpmSubLayerDeleteByKey0, FwpmProviderContextDeleteByKey0, FwpsAcquireClassifyHandle0, FwpsQueryPacketInjectionState0, FwpsFlowAssociateContext0, FwpmSubLayerAdd0, FwpmSubLayerCreateEnumHandle0, FwpmFreeMemory0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpmTransactionBegin0, FwpmEngineClose0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpsCalloutRegister1, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsInjectionHandleCreate0, FwpsCopyStreamDataToBuffer0, FwpsInjectNetworkReceiveAsync0, FwpsAcquireWritableLayerDataPointer0, FwpsApplyModifiedLayerData0, FwpsAllocateNetBufferAndNetBufferList0, FwpsInjectTransportSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectNetworkSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsFreeCloneNetBufferList0, FwpsInjectionHandleDestroy0, FwpsFlowRemoveContext0, FwpsCloneStreamData0, FwpsCompleteClassify0, FwpsReleaseClassifyHandle0, FwpsDiscardClonedStreamData0, FwpsStreamInjectAsync0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0
Source: is-AIA31.tmp.2.dr	Static PE information: Found NDIS imports: FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0
Source: is-L37FQ.tmp.2.dr	Static PE information: Found NDIS imports: FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0
Source: is-OP4DR.tmp.2.dr	Static PE information: Found NDIS imports: FwpmFilterDeleteById0, FwpmSubLayerDeleteByKey0, FwpmSubLayerAdd0, FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FwpmGetAppIdFromFileName0

Source: ComDebug.exe, 00000005.00000002.2481144877.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp) equals www.yahoo.com (Yahoo)

Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000002A.00000002.3310802841.000001A03393B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CiValue&gt
Source: svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000002A.00000003.2731702082.000001A03480D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690026448.000001A03417A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692733625.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730686541.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692070040.000001A034B17000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2678333348.000001A034158000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000002A.00000002.3311644495.000001A034841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310308735.000001A033899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 0000002A.00000002.3312339997.000001A0348CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_AAAAAAAA
Source: svchost.exe, 0000002A.00000002.3312339997.000001A0348CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_AAAAAAAAAA
Source: svchost.exe, 0000002A.00000002.3312339997.000001A0348CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_IssuedDa
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3381816238.00000000088EE000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://aia.entrust.net/ts2-chain256.p7c01
Source: FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr, is-NP4VA.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.00000000088A1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000884D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/cs
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3381816238.00000000088EE000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://crl.entrust.net/ts2ca.crl0
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000028.00000002.3312496939.0000020070600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310591981.000001A0338DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2610849451.000001A0338E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA384
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.00000000088A1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000884D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr, is-NP4VA.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.00000000088A1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000884D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: FastestVPN.exe, 0000001D.00000002.3377576940.00000000087CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en-
Source: FastestVPN.exe, 0000001D.00000002.3377576940.00000000088A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: FastestVPN.exe, 0000001D.00000002.3320854485.0000000002F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttf
Source: FastestVPN.exe, 0000001D.00000002.3320854485.0000000002F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfd
Source: svchost.exe, 0000002A.00000003.2741537688.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2753209931.000001A034108000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730997599.000001A034107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2731021322.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2753261219.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2716809154.000001A034107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2716834523.000001A03410E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/
Source: svchost.exe, 0000002A.00000003.2751244266.000001A034186000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3311193854.000001A034113000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2731480446.000001A0348A2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3311739359.000001A034869000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3311490497.000001A034182000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738709577.000001A034183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd-cbc
Source: svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/www
Source: svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdithm
Source: svchost.exe, 0000002A.00000003.2690026448.000001A03417A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000002A.00000003.2678885368.000001A034107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdttp://
Source: svchost.exe, 0000002A.00000003.2751342869.000001A034183000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2751774622.000001A034184000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738709577.000001A034183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xshttp://Passport.NET/
Source: svchost.exe, 0000002A.00000002.3311490497.000001A034182000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738709577.000001A034183000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730944129.000001A034130000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd//www
Source: svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd/200
Source: svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd/www
Source: svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdOAPF
Source: svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdithm
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2751715173.000001A03417C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds-cbc
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdxV
Source: svchost.exe, 00000028.00000003.2578366557.00000200704A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2481847966.0000000002892000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.yahoo.com/help/us/ysearch/slurp)
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: http://ip-api.com/json
Source: FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.00000000088A1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000884D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr, is-NP4VA.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0R
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3381816238.00000000088EE000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: http://ocsp.sectigo.com0.
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: svchost.exe, 0000002A.00000002.3310381586.000001A0338B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000024.00000002.2610109874.0000000004DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
Source: FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcessd
Source: svchost.exe, 0000002A.00000002.3310802841.000001A03393B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microso
Source: FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2753173898.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2716778281.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730997599.000001A034107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2678916510.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2741513997.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738651210.000001A034186000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730582575.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2691554548.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2716809154.000001A034107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2751244266.000001A034186000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730944129.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyce
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738651210.000001A034186000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730582575.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2751244266.000001A034186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738651210.000001A034186000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730582575.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2592837643.000001A034132000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2751244266.000001A034186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000002A.00000003.2731702082.000001A03480D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692733625.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730686541.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692070040.000001A034B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee
Source: svchost.exe, 0000002A.00000003.2691554548.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuessue
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310591981.000001A0338DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2592837643.000001A034132000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2691554548.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2610109874.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: http://signalr.net/
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: is-NP4VA.tmp.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com
Source: ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com/
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com/blog/how-to-activate-using-license-key/openU
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openU
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com/help/
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com/openU
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.comopenS
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.comopenU
Source: FastestVPN.exe, 0000001D.00000000.2537268642.000000000076D000.00000002.00000001.01000000.0000000D.sdmp, FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3370837677.0000000005E82000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: powershell.exe, 00000024.00000002.2610109874.0000000004DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.00000000088A1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000884D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-O947P.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: ComDebug.exe, 00000005.00000002.2481847966.000000000287D000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/bot.html)
Source: ComDebug.exe, 00000005.00000002.2481144877.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp, FastestVPN.exe, 0000001D.00000002.3361390632.0000000005B2A000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.hardcodet.net/projects/wpf-notifyicon
Source: FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.hardcodet.net/taskbar
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2481847966.0000000002850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: more.com, 0000000D.00000002.2674557354.00000000029AA000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.0000000005032000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: is-TQ205.tmp.2.dr	String found in binary or memory: http://www.openssl.org/V
Source: is-TQ205.tmp.2.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: is-TQ205.tmp.2.dr	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.somewhere.org
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: svchost.exe, 0000002A.00000003.2689083903.000001A034107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSi
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806011
Source: svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuer
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590826566.000001A034157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 00000024.00000002.2610109874.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBcq
Source: is-EAFR9.tmp.2.dr	String found in binary or memory: https://aka.ms/signalr-core-differences
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://api.fastestvpn.com//v2/chat
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://api.fastestvpn.com/v2
Source: powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/about
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/buy-vpn
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/buy-vpn?device=windows
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/faq?device=windows
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/password/reset
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/privacy-policy
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://fastestvpn.com/terms-of-service?device=windows
Source: FastestVPN.exe	String found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc
Source: FastestVPN.exe, 0000001D.00000002.3359514963.0000000005932000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5Enjoy
Source: svchost.exe, 00000028.00000003.2578366557.0000020070513000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000028.00000003.2578366557.00000200704A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: FastestVPN.exe, 0000001D.00000002.3387714719.0000000008C12000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000000.2537268642.00000000005A2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)
Source: powershell.exe, 00000024.00000002.2610109874.0000000004DA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp, is-EAFR9.tmp.2.dr	String found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc
Source: is-CVIBF.tmp.2.dr	String found in binary or memory: https://github.com/aspnet/AspNetKatana
Source: FastestVPN.exe	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ff
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358045747.00000000058A2000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: FastestVPN.exe, 0000001D.00000002.3358045747.00000000058A2000.00000002.00000001.01000000.00000018.sdmp, FastestVPN.exe, 0000001D.00000002.3408228429.000000000BEB2000.00000002.00000001.01000000.00000036.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: FastestVPN.exe	String found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac73275
Source: FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3357098503.0000000005872000.00000002.00000001.01000000.00000017.sdmp, FastestVPN.exe, 0000001D.00000002.3357302797.0000000005882000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 0000001D.00000002.3320296929.0000000002C62000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, FastestVPN.exe, 0000001D.00000002.3404635413.000000000BD82000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr, is-3M67B.tmp.2.dr	String found in binary or memory: https://github.com/ericsink/SQLitePCL.raw
Source: FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, is-3M67B.tmp.2.dr	String found in binary or memory: https://github.com/ericsink/SQLitePCL.rawH
Source: FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr	String found in binary or memory: https://github.com/ericsink/SQLitePCL.rawX
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://github.com/hardcodet/wpf-notifyicon
Source: FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://github.com/hardcodet/wpf-notifyicon.
Source: powershell.exe, 00000024.00000002.2610109874.0000000004E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp	String found in binary or memory: https://in.appcenter.ms
Source: FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp	String found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
Source: OqAVRCkQ3T.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.li
Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.
Source: svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists
Source: svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavoamp;id=8
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3312460581.000001A0348F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310070375.000001A03382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfuer
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2691554548.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000002A.00000002.3310070375.000001A03382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000002A.00000003.2702713441.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3311889003.000001A0348A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2731480446.000001A0348A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Dtm1aTGRxEryQgX
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000002A.00000003.2702713441.000001A03410E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2710403066.000001A034840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3311644495.000001A034841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590933753.000001A03416B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfe
Source: svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600s
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806015
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590826566.000001A034157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000002A.00000003.2590564723.000001A03415A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cpoW
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000002A.00000002.3310070375.000001A03382B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310070375.000001A03382B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310070375.000001A03382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srfce
Source: svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000002A.00000002.3311820110.000001A034878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000002A.00000002.3311820110.000001A034878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfo
Source: svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfie
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfen
Source: powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: FastestVPN.exe, 0000001D.00000002.3387714719.0000000008C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL
Source: FastestVPN.exe, 0000001D.00000000.2537268642.00000000005A2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://scripts.sil.org/OFLThis
Source: FastestVPN.exe, 0000001D.00000000.2537268642.00000000005A2000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigo
Source: is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com
Source: ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/blog/credits-and-acknowledgements/open
Source: ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/files/batch-url-downloader.exe
Source: ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/files/text-edit-plus.exe
Source: ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/files/vov-sticky-notes.exe
Source: more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp, is-ON3RQ.tmp.2.dr, is-NP4VA.tmp.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3381816238.00000000088EE000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: OqAVRCkQ3T.exe, 00000000.00000003.2909012937.0000000002216000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2061980537.0000000002730000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2068491533.00000000033A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.fastestvpn.com/
Source: OqAVRCkQ3T.exe, 00000000.00000003.2063529817.0000000002730000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2064192255.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2065963797.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: OqAVRCkQ3T.exe, 00000000.00000003.2063529817.0000000002730000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2064192255.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2065963797.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: C:\Program Files\FastestVPN\FastestVPN.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET139B.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-PU5N8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CDPP5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-48IDT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FJ6LN.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\SET107E.tmp	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

.NET source code contains very large strings

Source: is-C4FPO.tmp.2.dr, WelcomePage.cs

Long String: Length: 14757

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe

Code function: 5_2_007A5076 NtQuerySystemInformation,

5_2_007A5076

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_10014000: ?nf_getDriverType@nfapi@@YAKXZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,

31_2_10014000

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_100134A0 ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z,OpenSCManagerA,OpenServiceA,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetLastError,

31_2_100134A0

Source: C:\Windows\System32\xcopy.exe

File created: C:\Windows\system32\drivers\fastestvpndriver.sys

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}

Jump to behavior

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET1ED5.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET1ED5.tmp	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	File created: C:\Windows\system32\drivers\fastestvpndriver.sys
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET134C.tmp

Jump to behavior

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Code function: 5_2_007A3000	5_2_007A3000
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D41D0	11_2_00007FF6CB9D41D0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D52E0	11_2_00007FF6CB9D52E0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F4B7C	11_2_00007FF6CB9F4B7C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D7030	11_2_00007FF6CB9D7030
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F4E5C	11_2_00007FF6CB9F4E5C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA183E4	11_2_00007FF6CBA183E4
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F4430	11_2_00007FF6CB9F4430
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA14340	11_2_00007FF6CBA14340
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA222DC	11_2_00007FF6CBA222DC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E0B0	11_2_00007FF6CBA0E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA12160	11_2_00007FF6CBA12160
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F41AC	11_2_00007FF6CB9F41AC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA12920	11_2_00007FF6CBA12920
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F4914	11_2_00007FF6CB9F4914
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA1A7C0	11_2_00007FF6CBA1A7C0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E810	11_2_00007FF6CBA0E810
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0C738	11_2_00007FF6CBA0C738
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA166E8	11_2_00007FF6CBA166E8
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA02640	11_2_00007FF6CBA02640
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F4698	11_2_00007FF6CB9F4698
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0BD18	11_2_00007FF6CBA0BD18
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F3C8C	11_2_00007FF6CB9F3C8C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA19BC0	11_2_00007FF6CBA19BC0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F59DC	11_2_00007FF6CB9F59DC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA1A070	11_2_00007FF6CBA1A070
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E0B0	11_2_00007FF6CBA0E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA03F14	11_2_00007FF6CBA03F14
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F3F10	11_2_00007FF6CB9F3F10
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA11154	11_2_00007FF6CBA11154
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D13E0	11_2_00007FF6CB9D13E0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F5430	11_2_00007FF6CB9F5430
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9DB1FC	11_2_00007FF6CB9DB1FC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA1D168	11_2_00007FF6CBA1D168
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA11154	11_2_00007FF6CBA11154
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F5150	11_2_00007FF6CB9F5150
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA196F0	11_2_00007FF6CBA196F0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9F56FC	11_2_00007FF6CB9F56FC
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C22063	29_2_02C22063
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C220C0	29_2_02C220C0
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C2208C	29_2_02C2208C
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_053D699C	29_2_053D699C
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_053D3D9F	29_2_053D3D9F
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588701A	29_2_0588701A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588712E	29_2_0588712E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05886E58	29_2_05886E58
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_058E3C1A	29_2_058E3C1A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_058E2FE2	29_2_058E2FE2
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05B15CD6	29_2_05B15CD6
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05B14900	29_2_05B14900
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05F63276	29_2_05F63276
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05F633B9	29_2_05F633B9
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05F66998	29_2_05F66998
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDD305A	29_2_0BDD305A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDD317E	29_2_0BDD317E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDD4799	29_2_0BDD4799
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDFBB59	29_2_0BDFBB59
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDF26E8	29_2_0BDF26E8
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDF5D0B	29_2_0BDF5D0B
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE75C52	29_2_0BE75C52
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FF3828	29_2_00FF3828
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFD015	29_2_00FFD015
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFD162	29_2_00FFD162
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05E9B090	29_2_05E9B090
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05E97BD1	29_2_05E97BD1
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05E90D28	29_2_05E90D28
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05E90D18	29_2_05E90D18
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05E9BA97	29_2_05E9BA97
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE64258	29_2_0BE64258
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE6CDE8	29_2_0BE6CDE8
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE6C1D0	29_2_0BE6C1D0
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE68198	29_2_0BE68198
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE6C518	29_2_0BE6C518
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0C1109F8	29_2_0C1109F8
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05F65D9D	29_2_05F65D9D
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_00402920	31_2_00402920
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_00404DDB	31_2_00404DDB
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_10002060	31_2_10002060
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_1000A0A0	31_2_1000A0A0
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_10009A81	31_2_10009A81
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_10005C60	31_2_10005C60
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_1000BD21	31_2_1000BD21
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_10001620	31_2_10001620
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 35_2_04EE3366	35_2_04EE3366
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 35_2_04EE38B4	35_2_04EE38B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_02E2A528	36_2_02E2A528
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_02E2ADF8	36_2_02E2ADF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 36_2_02E2A1E0	36_2_02E2A1E0
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Code function: 48_2_00CE5F38	48_2_00CE5F38
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_010383F6	49_2_010383F6

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: String function: 1000A044 appears 35 times
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: String function: 0103E03C appears 110 times
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: String function: 0103E368 appears 75 times
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: String function: 00007FF6CBA081A8 appears 48 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7136 -ip 7136

Source: OqAVRCkQ3T.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-HMSV9.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: OqAVRCkQ3T.exe, 00000000.00000003.2064192255.000000007FE2E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
Source: OqAVRCkQ3T.exe, 00000000.00000003.2063529817.0000000002802000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
Source: OqAVRCkQ3T.exe, 00000000.00000000.2061171873.00000000004B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs OqAVRCkQ3T.exe
Source: OqAVRCkQ3T.exe	Binary or memory string: OriginalFileName vs OqAVRCkQ3T.exe

Source: OqAVRCkQ3T.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"

Source: is-O6V0U.tmp.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: is-NP4VA.tmp.2.dr

Binary string: \Device\CtrlSM

Source: FastestVPN.exe, 0000001D.00000002.3394226788.000000000B336000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.T;;.VBp

Source: classification engine

Classification label: mal64.troj.spyw.evad.winEXE@83/332@0/1

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D52E0 CharNextW,CharNextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,	11_2_00007FF6CB9D52E0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D4D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,	11_2_00007FF6CB9D4D80
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_100139D0 ?nf_adjustProcessPriviledges@nfapi@@YAXXZ,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,	31_2_100139D0
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_0101CA79 LookupPrivilegeValueW,AdjustTokenPrivileges,PrivilegeCheck,GetLastError,_CxxThrowException,	49_2_0101CA79

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,

31_2_10013540

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,

31_2_10013540

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

File created: C:\Program Files\FastestVPN

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

File created: C:\Users\Public\Desktop\FastestVPN.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:760:120:WilError_03
Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Mutant created: NULL
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6752:120:WilError_03
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Mutant created: \Sessions\1\BaseNamedObjects\F7ADS2TDE9SFT7VCP4NAF2A1S4TAE7S8TBVDPEN5FAA3S0T3EFS6T1V4PDN4F8user
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\8C9EED5B-604B-4700-866A-6A9606527CC6
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2576:120:WilError_03
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Mutant created: \Sessions\1\BaseNamedObjects\VOVSOFT_Batch_URL_Downloader
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7136
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:760:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4820

Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe

File created: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Command line argument: nfregdvr

31_2_00401050

Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: tapinstall.exe	String found in binary or memory: of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after. I
Source: tapinstall.exe	String found in binary or memory: itioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
Source: FastestVPN.WindowsService.exe	String found in binary or memory: registerHubProxies(proxies, true); this._registerSubscribedHubs(); }).disconnected(function () { // Unsubscribe all hub proxies when we "disconnect". This is to ensure that we do not re-add functional call backs.
Source: OqAVRCkQ3T.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe

File read: C:\Users\user\Desktop\OqAVRCkQ3T.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\OqAVRCkQ3T.exe "C:\Users\user\Desktop\OqAVRCkQ3T.exe"
Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Process created: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp "C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp" /SL5="$20440,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe"
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe"
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000158"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Windows 7"
Source: unknown	Process created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7136 -ip 7136
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 1076
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4820 -ip 4820
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 384
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
Source: C:\Program Files\FastestVPN\subinacl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNService
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Process created: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp "C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp" /SL5="$20440,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNService	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000158"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Windows 7"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7136 -ip 7136
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 1076
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4820 -ip 4820
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 384
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dwrite.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: sspicli.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: mswsock.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3d9.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: urlmon.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: iertutil.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winsta.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: powrprof.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: umpdc.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3d11.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dcomp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dxgi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dxcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: textshaping.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wintypes.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wintypes.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wintypes.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msctfui.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: propsys.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: d3dcompiler_47.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winmm.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msasn1.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: riched20.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: usp10.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: msls31.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: gpapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: cryptnet.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winnsi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: winhttp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: webio.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: amsi.dll
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Section loaded: nfapi.dll
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Section loaded: nfapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: tquery.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: mssrch.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: cryptdll.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: esent.dll
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Section loaded: shdocvw.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: mscoree.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: urlmon.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: iertutil.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: sspicli.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: propsys.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: riched20.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: usp10.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: msls31.dll
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Section loaded: gpapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: apphelp.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: mfc42u.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: msvcirt.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: msvcp60.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: version.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: netapi32.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: mpr.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: clusapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: samlib.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: srvcli.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: netutils.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: logoncli.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: samcli.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\FastestVPN\subinacl.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Automated click: I accept the agreement

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa

Source: C:\Program Files\FastestVPN\FastestVPN.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-F31HU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-8SCCE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-3QH42.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-29PQI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-6P2C9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-BT6B4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-IN04I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-FP6VU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-EEEM3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-H0O73.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-LEV7B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-O6V0U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-TJLQ2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-JS6M2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-CPTP7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-7D6TA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-G38N1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-RAUHQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-TIJQU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-QAEOR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-6HFVM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-HT2O2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-OV817.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-EAFR9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-GP1QP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-FMQAJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-SELKR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-6OAGB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-7KO33.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-HGUF4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-IQIIH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-O947P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-3M67B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-0A8FD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-7ULB1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-HG5LC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-69FAA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-KPVP8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-8KR34.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-0BOGR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-ILS2N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-AJ7UA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-G6DJI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-RR5LV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-SBGRB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-U9EKE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-D2992.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-1DJ4G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-OE3IT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-Q5PL9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-E834D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-TQ205.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-7CHS6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-STKUM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-IOEQA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-0GCGM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-KLMTU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-DQ0IA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-SQ4JH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-1J41S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-HQ1IR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-PVULV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-I47CR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-9AF3F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QAA9O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-UA1JD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-QTAN0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-H0796.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-M395B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\is-92POB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-OVOMN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-SKNAP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-NMBSC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\data\is-7G3MI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-OIO4P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\is-KSP41.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-RVBPK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PVM3P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-48IDT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-GOJKM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ON3RQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-J4FPP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DHPIR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6JP0F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FJ6LN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-CL5M9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3LE8C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3U4F4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-32KE2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-5RGR2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-PU5N8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-JDOCE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-INGVK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-74SDR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-7CFS6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-0PS85.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CDPP5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-E3JOD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GTT7V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-HUQLV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-7URTB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\is-DHG8F.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-NP4VA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-KQVDN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-AIA31.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-L37FQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-DFAQV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Resources\sp\release\is-9KLB3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-NRIKT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-RSP45.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-N257N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-OP4DR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-TKLHN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-HMSV9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-GV36A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-C4FPO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-G5QC8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-25GUT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-CVIBF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-B2JMI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-KA6B7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-TF74Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-BU4VV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-0P3G0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-T1I9D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-25JMN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-SGO0H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-SA7LQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-9V0LH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-BEQUD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\Service\is-GNOTT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Directory created: C:\Program Files\FastestVPN\is-20RRP.tmp	Jump to behavior
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Directory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1

Jump to behavior

Source: OqAVRCkQ3T.exe

Static PE information: certificate valid

Source: OqAVRCkQ3T.exe

Static file information: File size 30699768 > 1048576

Source: OqAVRCkQ3T.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr
Source:	Binary string: E:\A\_work\500\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: is-69FAA.tmp.2.dr
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000B.00000000.2457382058.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000C.00000002.2532589822.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, tapinstall.exe, 0000000C.00000000.2462265454.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmp, is-ON3RQ.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdb4 source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdb source: is-EAFR9.tmp.2.dr
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: is-SA7LQ.tmp.2.dr
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2767595544.0000000004EE2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdb* source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, is-3M67B.tmp.2.dr
Source:	Binary string: indows\FastestVPN.WindowsService.pdbpdbice.pdbdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: wntdll.pdb source: more.com, 0000000D.00000002.2675419337.0000000004610000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2675138446.00000000042B5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743176963.0000000004CD5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743459476.0000000005140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3359514963.0000000005932000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb13 source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, subinacl.exe, 00000031.00000000.2806088673.0000000001001000.00000020.00000001.01000000.00000037.sdmp, subinacl.exe, 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3357098503.0000000005872000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3355343741.00000000053D2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdbes source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: is-SA7LQ.tmp.2.dr
Source:	Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3319377426.0000000002C22000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3357302797.0000000005882000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: is-CVIBF.tmp.2.dr
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.PDBE source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, is-3M67B.tmp.2.dr
Source:	Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdbW source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, subinacl.exe, 00000031.00000000.2806088673.0000000001001000.00000020.00000001.01000000.00000037.sdmp, subinacl.exe, 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3376197070.0000000006122000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3376197070.0000000006122000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358045747.00000000058A2000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358329842.00000000058B2000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, nfregdrv.exe, 00000020.00000002.2554138371.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, is-DFAQV.tmp.2.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, nfregdrv.exe, 00000020.00000002.2554138371.0000000010019000.00000002.00000001.01000000.0000000F.sdmp, is-DFAQV.tmp.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3357098503.0000000005872000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3376379672.0000000006132000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 0000001F.00000000.2548428166.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000002.2551051706.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000000.2550595786.0000000000408000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 0000001D.00000002.3404635413.000000000BD82000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: Microsoft.Owin.Hosting.pdb source: is-CVIBF.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3320152253.0000000002C52000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3376379672.0000000006132000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdbs source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\ServerL source: FastestVPN.exe, 0000001D.00000002.3381816238.0000000008931000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3357302797.0000000005882000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: @&n.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3319377426.0000000002C22000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3370837677.0000000005E82000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Client/Release/net45/Microsoft.AspNet.SignalR.Client.pdbSHA256 source: is-EAFR9.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3359514963.0000000005932000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3404635413.000000000BD82000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: FastestVPN.exe, 0000001D.00000002.3355343741.00000000053D2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: FastestVPN.exe
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.2547935355.00000252C25CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: more.com, 0000000D.00000002.2675419337.0000000004610000.00000004.00001000.00020000.00000000.sdmp, more.com, 0000000D.00000002.2675138446.00000000042B5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743176963.0000000004CD5000.00000004.00000020.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743459476.0000000005140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 0000001F.00000000.2548428166.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000002.2551051706.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, nfregdrv.exe, 00000020.00000000.2550595786.0000000000408000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: is-AJ7UA.tmp.2.dr
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: FastestVPN.exe, 0000001D.00000000.2537268642.000000000076D000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2767595544.0000000004EE2000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3359770945.0000000005942000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3320296929.0000000002C62000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2753669452.0000000000988000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000002.2763331623.0000000002A86000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000023.00000000.2557472879.00000000005F2000.00000002.00000001.01000000.00000020.sdmp, is-RSP45.tmp.2.dr
Source:	Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^\|^ n^_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: FastestVPN.exe, 0000001D.00000002.3320152253.0000000002C52000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: mscorlib.pdb source: FastestVPN.exe, 0000001D.00000002.3309559147.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 00000011.00000003.2491247191.000002C9303BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\projects\projectsj\nfsdk2_1.6\driver_wfp\std\objfre_win7_amd64\amd64\netfilter2.pdb source: is-NP4VA.tmp.2.dr
Source:	Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3320296929.0000000002C62000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 0000001D.00000002.3370837677.0000000005E82000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000023.00000002.2754476038.0000000000B61000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: H:\Projects\NetFilter SDK\iphelperclose\Release\iphelperclose.pdb source: is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr
Source:	Binary string: E:\A\_work\500\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb? source: is-69FAA.tmp.2.dr
Source:	Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID

Source: is-NRIKT.tmp.2.dr

Static PE information: 0xAB462008 [Fri Jan 21 02:20:56 2061 UTC]

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CB9D6C90 SetupOpenInfFileW,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupFindFirstLineW,SetupGetStringFieldW,CLSIDFromString,SetupDiGetClassDescriptionExW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupGetStringFieldW,SetupCloseInfFile,FreeLibrary,

11_2_00007FF6CB9D6C90

Source: OqAVRCkQ3T.exe	Static PE information: section name: .didata
Source: OqAVRCkQ3T.tmp.0.dr	Static PE information: section name: .didata

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Code function: 5_2_007A7256 push 00000078h; ret	5_2_007A7259
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Code function: 5_2_007A8FA5 push 00000078h; ret	5_2_007A8FA9
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA1C52C push rsp; retn 0004h	11_2_00007FF6CBA1C52D
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA1C576 push rsi; ret	11_2_00007FF6CBA1C579
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C22063 push es; ret	29_2_02C22570
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C220C0 push es; ret	29_2_02C22570
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C2208C push es; ret	29_2_02C22570
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C225AD push es; ret	29_2_02C2283C
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C6435D push es; retf	29_2_02C6437E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_02C6437F push es; retf	29_2_02C6445C
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_053D8DCE push ss; ret	29_2_053D8DE8
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588AF04 push cs; retf	29_2_0588AF0E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588AF10 push cs; retf	29_2_0588AF1A
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588AD3F push cs; ret	29_2_0588ADBC
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588ADC0 push cs; ret	29_2_0588AE10
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_058882C7 push ss; ret	29_2_058882CA
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_058879DF push es; retf	29_2_05887A7E
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0588AEF2 push cs; retf	29_2_0588AEF6
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_058E3564 push es; ret	29_2_058E3585
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_058E2FE2 push es; ret	29_2_058E3585
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_06135883 push cs; ret	29_2_061358CC
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDF56FA push ss; iretd	29_2_0BDF5702
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BDF7F11 push cs; ret	29_2_0BDF7F12
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0BE75A5F push 00000028h; retf 0000h	29_2_0BE75A62
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFEFCA pushfd ; iretd	29_2_00FFEFF9
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFEFC0 pushad ; iretd	29_2_00FFEFC9
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFB4B5 pushfd ; iretd	29_2_00FFB4F9
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFB438 pushfd ; iretd	29_2_00FFB4F9
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_00FFB5B0 push D000005Fh; iretd	29_2_00FFB5C9
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_05E90148 push esp; iretd	29_2_05E901F1
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Code function: 29_2_0C1136B2 push E40C0C73h; retf	29_2_0C1136BD

Source: is-O6V0U.tmp.2.dr

Static PE information: section name: .text entropy: 7.662424467871785

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-SGO0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-SELKR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-H0796.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-DQ0IA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-E834D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-7D6TA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\nfapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-TF74Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\subinacl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-EAFR9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-TIJQU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-7CHS6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-RSP45.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-TQ205.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-HQ1IR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-6OAGB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-QAEOR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-UA1JD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-29PQI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-C4FPO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-FP6VU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-IOEQA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-AIA31.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\System.Memory.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-RAUHQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-D2992.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-GV36A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-NP4VA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-I47CR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-QTAN0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-GNOTT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-0GCGM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-CVIBF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-G6DJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-8SCCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-9V0LH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-0BOGR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-L37FQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-INGVK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-SBGRB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-KLMTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-25JMN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET1409.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-3QH42.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-6P2C9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET1ED5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-G5QC8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-6HFVM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-0A8FD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-TKLHN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-SA7LQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-U9EKE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-BEQUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-BU4VV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-OV817.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-STKUM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-B2JMI.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-7ULB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-KA6B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GTT7V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-HGUF4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\is-DFAQV.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	File created: C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\SET108E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-GP1QP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-3M67B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Flurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-G38N1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-H0O73.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\System.Buffers.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-M395B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-OP4DR.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	File created: C:\Users\user\AppData\Local\Temp\fqik	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-8KR34.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-JDOCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\nfapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-QAA9O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-NRIKT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-HT2O2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	File created: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-69FAA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-AJ7UA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-T1I9D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-JS6M2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-IQIIH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-GOJKM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-FMQAJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-F31HU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-CL5M9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-RR5LV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-BT6B4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-O947P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-0P3G0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3LE8C.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Windows\System32\drivers\fastestvpndriver.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-KPVP8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-7KO33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-HMSV9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\is-9KLB3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-SQ4JH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-1J41S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KIVL3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-1DJ4G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\is-25GUT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-Q5PL9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-OE3IT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-HG5LC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\is-92POB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\is-O6V0U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-E3JOD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-KQVDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ON3RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SET1ED5.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Windows\System32\drivers\fastestvpndriver.sys	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET1409.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\fqik

Jump to dropped file

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	File created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Jump to behavior

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk	Jump to behavior

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

31_2_10013540

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\FQIK

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Users\user\Desktop\OqAVRCkQ3T.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive system registry key value via command line tool

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"

Switches to a custom stack to bypass stack traces

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	API/Special instruction interceptor: Address: 764A7B27
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	API/Special instruction interceptor: Address: 764A781D
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 764A3B97
Source: C:\Windows\SysWOW64\SearchIndexer.exe	API/Special instruction interceptor: Address: 102DC57

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: FF0000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Memory allocated: 1010000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: D30000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 2A00000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: 2780000 memory reserve \| memory write watch
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Memory allocated: C40000 memory reserve \| memory write watch

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CB9D4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,

11_2_00007FF6CB9D4820

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Window / User API: threadDelayed 1879
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Window / User API: threadDelayed 1261
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2009
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 359

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-HGUF4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\release\is-DFAQV.tmp	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\SET108E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-SGO0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-SELKR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-H0796.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-3M67B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-GP1QP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-DQ0IA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-E834D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-G38N1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-H0O73.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Buffers.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-M395B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-7D6TA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-TF74Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-OP4DR.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\more.com	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\fqik	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-8KR34.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-JDOCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-EAFR9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-TIJQU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QAA9O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-7CHS6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-NRIKT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-HT2O2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-TQ205.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-HQ1IR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-6OAGB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-69FAA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-AJ7UA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-QAEOR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-T1I9D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-UA1JD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-29PQI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-C4FPO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-IQIIH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-JS6M2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-FP6VU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-GOJKM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-IOEQA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-FMQAJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-CL5M9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-F31HU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-RR5LV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-AIA31.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Memory.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-RAUHQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-BT6B4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-O947P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-0P3G0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-D2992.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-GV36A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3LE8C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-NP4VA.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\fastestvpndriver.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-I47CR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QTAN0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-GNOTT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-0GCGM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-CVIBF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-KPVP8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-G6DJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-7KO33.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-8SCCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-9V0LH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-0BOGR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-L37FQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-KLMTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-HMSV9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-SBGRB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-25JMN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-SQ4JH.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET1409.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-3QH42.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-1J41S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KIVL3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-6P2C9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SET1ED5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-1DJ4G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-G5QC8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-6HFVM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-Q5PL9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-25GUT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-TKLHN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-SA7LQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-U9EKE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-BEQUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-BU4VV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-HG5LC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-STKUM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-OV817.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-B2JMI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-92POB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\is-7ULB1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-E3JOD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-KA6B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-KQVDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GTT7V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ON3RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Dropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)	Jump to dropped file

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	API coverage: 5.8 %
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	API coverage: 3.4 %

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe TID: 432	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 5176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6136	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep count: 2009 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep count: 359 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3144	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 2412	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Program Files\FastestVPN\FastestVPN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0ECAC FindFirstFileExW,FindNextFileW,FindClose,	11_2_00007FF6CBA0ECAC
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	11_2_00007FF6CBA0E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E810 FindFirstFileExW,	11_2_00007FF6CBA0E810
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA0E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	11_2_00007FF6CBA0E0B0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,	11_2_00007FF6CB9D3630
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,	49_2_0103172D
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,	49_2_01031DDF

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,

31_2_100163B0

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_100013F0 ResetEvent,GetSystemInfo,

31_2_100013F0

Source: C:\Program Files\FastestVPN\FastestVPN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Program Files\FastestVPN\Resources\driver\	Jump to behavior

Source: SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: powershell.exe, 00000024.00000002.2601740426.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: svchost.exe, 0000002A.00000003.2716778281.000001A034130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6F875qY3FC4YjperNlCg5QJOuc5J8CmPlURw9xFprZUl+228vULaY+qr/IXdZN+N2EQauuODRJnJkVacdAtt6L8svWEbtiYOgsD4ANBAHYHyVAbU9tMBoVw9/yn1R5TttnetXyx7WdVDQe1UVmCINigFhcZJofu6XtFlXz/7Yy1wkr7ELrMHaJZHcANeE14QuVbtZ9JrBOBRXKBjAqBneRu3tl2b8991AvfyawpuLR+12Uz77CUK7COvz9lZt6z2qadGaxLlNR5d4KDV0nFtFlseYIrTsdswcbvC0MBaiWB
Source: powershell.exe, 00000024.00000002.2601740426.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductTHVNU42ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.None
Source: SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3312578510.0000020070644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3310550021.000002006B02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.3312658194.0000020070656000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310491802.000001A0338D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: FastestVPN.exe, 0000001D.00000002.3309559147.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: powershell.exe, 00000024.00000002.2601740426.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 93VMware, Inc.Noney*
Source: svchost.exe, 0000002A.00000002.3310070375.000001A03382B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2892038572.0000000003424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}er~
Source: powershell.exe, 00000024.00000002.2601740426.0000000002B96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductTHVNU42ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.Noney*
Source: SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: FastestVPN.exe, 0000001D.00000002.3377576940.000000000887E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: svchost.exe, 0000002A.00000003.2716834523.000001A03410E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: oftware" Type="http://www.w3.org/2001/04/xmlenc#Element"><EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"></EncryptionMethod><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:KeyName>http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>M.C538_BL2.0.D.CsiDMFM6Otpp1drw/MsUJBpz5kxsyuGsA2R0G6hkaIJsTSI+bKAiOeTTuyYaByMKR4640pSWTRbmCSz8L+lj41VEbgnIvSmcYV/25uvezYQnx6Nj/Y5bqwzVbVWb77rzsHvuzIlfyknYyBYyFdenD58ROelKeRZgfk7NM1zTcFHlvO/AHHCXAqmYSazfWfypaThvT+FcJxDjjBpJkZIb88PPoesRLLvPCI+1XRWa3Fet8Uy6gwk0mIJsumhyDTb6C6F875qY3FC4YjperNlCg5QJOuc5J8CmPlURw9xFprZUl+228vULaY+qr/IXdZN+N2EQauuODRJnJkVacdAtt6L8svWEbtiYOgsD4ANBAHYHyVAbU9tMBoVw9/yn1R5TttnetXyx7WdVDQe1UVmCINigFhcZJofu6XtFlXz/7Yy1wkr7ELrMHaJZHcANeE14QuVbtZ9JrBOBRXKBjAqBneRu3tl2b8991AvfyawpuLR+12Uz77CUK7COvz9lZt6z2qadGaxLlNR5d4KDV0nFtFlseYIrTsdswcbvC0MBaiWB</CipherValue></CipherData></EncryptedData>
Source: svchost.exe, 0000002A.00000002.3310381586.000001A0338C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000013.00000003.2525314855.000001F57E521000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *@vmnetextension
Source: svchost.exe, 0000002A.00000003.2716778281.000001A034130000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: M.C538_BL2.0.D.CsiDMFM6Otpp1drw/MsUJBpz5kxsyuGsA2R0G6hkaIJsTSI+bKAiOeTTuyYaByMKR4640pSWTRbmCSz8L+lj41VEbgnIvSmcYV/25uvezYQnx6Nj/Y5bqwzVbVWb77rzsHvuzIlfyknYyBYyFdenD58ROelKeRZgfk7NM1zTcFHlvO/AHHCXAqmYSazfWfypaThvT+FcJxDjjBpJkZIb88PPoesRLLvPCI+1XRWa3Fet8Uy6gwk0mIJsumhyDTb6C6F875qY3FC4YjperNlCg5QJOuc5J8CmPlURw9xFprZUl+228vULaY+qr/IXdZN+N2EQauuODRJnJkVacdAtt6L8svWEbtiYOgsD4ANBAHYHyVAbU9tMBoVw9/yn1R5TttnetXyx7WdVDQe1UVmCINigFhcZJofu6XtFlXz/7Yy1wkr7ELrMHaJZHcANeE14QuVbtZ9JrBOBRXKBjAqBneRu3tl2b8991AvfyawpuLR+12Uz77CUK7COvz9lZt6z2qadGaxLlNR5d4KDV0nFtFlseYIrTsdswcbvC0MBaiWB
Source: OqAVRCkQ3T.tmp, 00000002.00000003.2892038572.0000000003424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\in
Source: svchost.exe, 00000013.00000003.2525574707.000001F57E517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @ethernetwlanppipvmnetextension4C}
Source: svchost.exe, 00000013.00000003.2525547681.000001F57E53A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @vmnetextension
Source: svchost.exe, 0000002A.00000002.3311531803.000001A034800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g=SHct=1727943833&hashalg=SHA256&bver=24&appid=Default&da=%3CEncryptedData%20xmlns%3D%22http://www.w3.org/2001/04/xmlenc%23%22%20Id%3D%22devicesoftware%22%20Type%3D%22http://www.w3.org/2001/04/xmlenc%23Element%22%3E%3CEncryptionMethod%20Algorithm%3D%22http://www.w3.org/2001/04/xmlenc%23tripledes-cbc%22%3E%3C/EncryptionMethod%3E%3Cds:KeyInfo%20xmlns:ds%3D%22http://www.w3.org/2000/09/xmldsig%23%22%3E%3Cds:KeyName%3Ehttp://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3EM.C538_BL2.0.D.CsiDMFM6Otpp1drw/MsUJBpz5kxsyuGsA2R0G6hkaIJsTSI%2BbKAiOeTTuyYaByMKR4640pSWTRbmCSz8L%2Blj41VEbgnIvSmcYV/25uvezYQnx6Nj/Y5bqwzVbVWb77rzsHvuzIlfyknYyBYyFdenD58ROelKeRZgfk7NM1zTcFHlvO/AHHCXAqmYSazfWfypaThvT%2BFcJxDjjBpJkZIb88PPoesRLLvPCI%2B1XRWa3Fet8Uy6gwk0mIJsumhyDTb6C6F875qY3FC4YjperNlCg5QJOuc5J8CmPlURw9xFprZUl%2B228vULaY%2Bqr/IXdZN%2BN2EQauuODRJnJkVacdAtt6L8svWEbtiYOgsD4ANBAHYHyVAbU9tMBoVw9/yn1R5TttnetXyx7WdVDQe1UVmCINigFhcZJofu6XtFlXz/7Yy1wkr7ELrMHaJZHcANeE14QuVbtZ9JrBOBRXKBjAqBneRu3tl2b8991AvfyawpuLR%2B12Uz77CUK7COvz9lZt6z2qadGaxLlNR5d4KDV0nFtFlseYIrTsdswcbvC0MBaiWB%3C/CipherValue%3E%3C/CipherData%3E%3C/EncryptedData%3E&nonce=%2FofG1B2UthyQSMaBaSOqw35n%2BIJR0xf9
Source: svchost.exe, 0000002A.00000003.2716997525.000001A034924000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,PO<AuthInfo><UserName>02lbkmdsiaduqqyj</UserName><UserPUID>00184010ED3AFF70</UserPUID><AuthState>0x48803</AuthState><CredProperties><puid>00184010ED3AFF70</puid><keypurposes><ps:KeyPurposes xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL"></ps:KeyPurposes></keypurposes><childflags>00000001</childflags><haspassword>1</haspassword><flags>60000040</flags><flagsv2>00000000</flagsv2><skipfrfs>0</skipfrfs><restrictedda>0</restrictedda><ip>8.46.123.33</ip><temporarypassword>0</temporarypassword><associatedforstrongauth>0</associatedforstrongauth><agegroup>0</agegroup><authmembername>02lbkmdsiaduqqyj@passport.com</authmembername></CredProperties><AuthToken><EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Id="devicesoftware" Type="http://www.w3.org/2001/04/xmlenc#Element"><EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"></EncryptionMethod><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:KeyName>http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>M.C538_BL2.0.D.CsiDMFM6Otpp1drw/MsUJBpz5kxsyuGsA2R0G6hkaIJsTSI+bKAiOeTTuyYaByMKR4640pSWTRbmCSz8L+lj41VEbgnIvSmcYV/25uvezYQnx6Nj/Y5bqwzVbVWb77rzsHvuzIlfyknYyBYyFdenD58ROelKeRZgfk7NM1zTcFHlvO/AHHCXAqmYSazfWfypaThvT+FcJxDjjBpJkZIb88PPoesRLLvPCI+1XRWa3Fet8Uy6gwk0mIJsumhyDTb6C6F875qY3FC4YjperNlCg5QJOuc5J8CmPlURw9xFprZUl+228vULaY+qr/IXdZN+N2EQauuODRJnJkVacdAtt6L8svWEbtiYOgsD4ANBAHYHyVAbU9tMBoVw9/yn1R5TttnetXyx7WdVDQe1UVmCINigFhcZJofu6XtFlXz/7Yy1wkr7ELrMHaJZHcANeE14QuVbtZ9JrBOBRXKBjAqBneRu3tl2b8991AvfyawpuLR+12Uz77CUK7COvz9lZt6z2qadGaxLlNR5d4KDV0nFtFlseYIrTsdswcbvC0MBaiWB</CipherValue></CipherData></EncryptedData></AuthToken><SessionKey>AwAAAAAQAAAEAAAAD2tzqvLqW7XA2v2ljn8VatSxDwNftMiBr68lEAcs4IJYJnL7UNfRnjQOmIKjfFBjAAAAAAW7iIUsyZ8yEJ1yx/i7ZW2I0uCThDFbeuaRQNzahjOvRQBGh6j4xEjwfu5Ju20T8FqDbNU3RpLad8VgiRQAAAAnht5HgYYHCFTId7vpVcjcGAAAAEZt/hiqYuyT6QztlwAAAAAQAAAAv1kX8FxQsuj4k+iPnGeePQwAAAC9uyPq/QDt6C3ZYlNmNtFMRMUWkX0FspIc7pLNAS7+xy2O/oo6FsWaYesgX36lxFCY38m3iEl1sBfMAJgmrXZH+TTp6DAnDf8YO9v08eZLhIAFX3rJE+QXSQBrZ10rPnkOF8HKIj1WwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyNyOwVGW7rnPeysEs2T+ZgkAAADfHkFV2SnxkqClBVQ6jB1/UEJ2Y1dZMGucat7bzGvjQzUkCNv8Mo4V02Rj0Kh1wicmm7sg0YdV7wqK0tJOiJycAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process queried: DebugPort
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\SearchIndexer.exe	Process queried: DebugPort

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CBA06788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00007FF6CBA06788

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

11_2_00007FF6CB9D6C90

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe

Code function: 5_2_007A5746 mov eax, dword ptr fs:[00000030h]

5_2_007A5746

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CBA157E0 GetProcessHeap,

11_2_00007FF6CBA157E0

Source: C:\Program Files\FastestVPN\subinacl.exe

Process token adjusted: Debug

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D8738 SetUnhandledExceptionFilter,	11_2_00007FF6CB9D8738
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CBA06788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF6CBA06788
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D8550 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00007FF6CB9D8550
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: 11_2_00007FF6CB9D7B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00007FF6CB9D7B18
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_004054F3 _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_004054F3
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_0040148B SetUnhandledExceptionFilter,	31_2_0040148B
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_0040134A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_0040134A
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_00402D4D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00402D4D
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_100081EF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_100081EF
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_1000B228 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_1000B228
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_10007CCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_10007CCF
Source: C:\Program Files\FastestVPN\subinacl.exe	Code function: 49_2_0103DEE7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	49_2_0103DEE7

Source: C:\Program Files\FastestVPN\FastestVPN.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtQuerySystemInformation: Direct from: 0x57EB6F	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtProtectVirtualMemory: Direct from: 0x6BB62FCA	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	NtSetInformationThread: Direct from: 0x7A63E7	Jump to behavior

LummaC encrypted strings found

Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: benchillppwo.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: publicitttyps.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: answerrsdo.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: radiationnopp.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: affecthorsedpo.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bargainnykwo.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bannngwko.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bouncedgowp.shop
Source: more.com, 0000000D.00000002.2675772646.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scatterdshsadyi.shop

Maps a DLL or memory area into another process

Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe

Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: 102B300			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\SearchIndexer.exe base: EC0000			Jump to behavior

Source: C:\Program Files\FastestVPN\subinacl.exe

Code function: 49_2_010383F6 __EH_prolog,#540,#538,#540,#540,#538,#2910,#861,#4197,#2755,#2910,#800,#800,#800,#800,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#4124,#858,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2756,#2910,swscanf,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#825,#4199,#2910,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,GetSecurityDescriptorLength,#823,GetLastError,#2910,#2910,LocalFree,LocalFree,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2910,_wtoi,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#6278,#6279,wcscmp,#2910,swscanf,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#540,#540,#2755,#858,#861,#4272,#858,#800,#4124,#858,#800,#2910,wcscmp,#2910,#2910,LogonUserW,GetLastError,#2910,#2910,#800,#800,#800,#800,#2910,#2755,#4272,#858,#800,#858,#861,#861,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#538,#4272,#858,#800,#4124,#858,#800,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#4272,#4124,#858,#800,#4197,#2910,#2910,#2910,#2910,#2910,#800,#537,#800,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#800,#2910,wcsncpy,#861,#861,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#2756,#2756,#2756,#2910,#2755,#4272,#858,#800,#5679,#861,#4273,#858,#800,#858,#941,#2910,#2755,#4272,#858,#800,#538,#925,#800,#2910,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2755,#540,#4272,#858,#800,#4124,#858,#800,#2756,#2756,#4124,#858,#800,#2910,#2910,wcscmp,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#2910,#800,#800,GetLastError,#2910,#2910,#2910,wcsncpy,wcsncpy,#2910,wcsncpy,#800,#800,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2910,#858,GetLastError,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#858,#861,#4124,#858,#800,#4272,#858,#800,#2910,#2910,#2910,#858,GetLastError,#2910,#2910,#2755,#4124,#858,#800,wcsncpy,#2910,GetLengthSid,GetLengthSid,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#4124,#858,#800,#6278,#6279,#4272,#858,#800,GetLastError,#2910,#2910,#2910,swscanf,#2910,GetLengthSid,GetLengthSid,GetLengthSid,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,

49_2_010383F6

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Process created: C:\Program Files\FastestVPN\Resources\ComDebug.exe "C:\Program Files\FastestVPN\Resources\ComDebug.exe"	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\SysWOW64\SearchIndexer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "x86"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "Windows 7"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7136 -ip 7136
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 1076
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4820 -ip 4820
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 384

Source: FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CBA21B20 cpuid

11_2_00007FF6CBA21B20

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	11_2_00007FF6CBA14CB8
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: try_get_function,GetLocaleInfoW,	11_2_00007FF6CBA08B44
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	11_2_00007FF6CBA14960
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,	11_2_00007FF6CBA15120
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00007FF6CBA14ED0
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	11_2_00007FF6CBA14E0C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	11_2_00007FF6CBA14D3C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	11_2_00007FF6CBA07BF8
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	11_2_00007FF6CBA07B7C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,	11_2_00007FF6CBA07A70
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00007FF6CBA15478
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,	11_2_00007FF6CBA1534C
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_00007FF6CBA15278
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: GetLocaleInfoA,	31_2_00406C2C
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: GetLocaleInfoA,	31_2_10011E31

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CB9D4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,

11_2_00007FF6CB9D4820

Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\System32\reg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\System32\reg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Windows\System32\reg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Windows\System32\reg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Source: C:\Windows\System32\reg.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId4

Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\ComDebug.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\f9c52751 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe	Queries volume information: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.DI.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.BLL.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\WpfAnimatedGif.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Newtonsoft.Json.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\System.Memory.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\FastestVPN.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation

Source: C:\Program Files\FastestVPN\FastestVPN.exe

Code function: 29_2_00FF27C8 CreateNamedPipeA,

29_2_00FF27C8

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Code function: 11_2_00007FF6CBA08BC8 try_get_function,GetSystemTimeAsFileTime,

11_2_00007FF6CBA08BC8

Source: C:\Program Files\FastestVPN\subinacl.exe

Code function: 49_2_0102E7AC __EH_prolog,#540,#2755,#858,#2910,#2910,LookupAccountNameW,#861,#942,#940,#4197,#4197,#800,#2910,#2910,LookupAccountNameW,#858,

49_2_0102E7AC

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe

Code function: 31_2_00401160 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

31_2_00401160

Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 Blob

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_10014170 ?nf_deleteBindingRules@nfapi@@YA?AW4_NF_STATUS@@XZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,		31_2_10014170
Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe	Code function: 31_2_100141E0 ?nf_addBindingRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_BINDING_RULE@1@H@Z,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,		31_2_100141E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 LSASS Driver	1 LSASS Driver	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	11 DLL Side-Loading	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	13 Service Execution	1 Valid Accounts	1 Valid Accounts	3 Obfuscated Files or Information	NTDS	1 Network Sniffing	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	44 Windows Service	11 Access Token Manipulation	2 Software Packing	LSA Secrets	295 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	2 Registry Run Keys / Startup Folder	44 Windows Service	1 Timestomp	Cached Domain Credentials	2 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	213 Process Injection	11 DLL Side-Loading	DCSync	251 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 File Deletion	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	43 Masquerading	/etc/passwd and /etc/shadow	61 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	2 Modify Registry	Input Capture	3 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	61 Virtualization/Sandbox Evasion	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	11 Access Token Manipulation	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	213 Process Injection	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OqAVRCkQ3T.exe	0%	ReversingLabs
OqAVRCkQ3T.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\FastestVPN.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Flurl.Http.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Flurl.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)	3%	ReversingLabs
C:\Program Files\FastestVPN\Resources\devcon.exe (copy)	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-INGVK.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-JDOCE.tmp	0%	ReversingLabs
C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	0%	URL Reputation	safe
http://schemas.datacontract.org	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	Virustotal		Browse
http://www.vmware.com/0	0%	Virustotal		Browse
https://fastestvpn.com/terms-of-service?device=windows	1%	Virustotal		Browse
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	Virustotal		Browse
http://vovsoft.com/blog/how-to-activate-using-license-key/openU	0%	Virustotal		Browse
https://vovsoft.com/files/text-edit-plus.exe	1%	Virustotal		Browse
benchillppwo.shop	22%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/09/policyce	0%	Virustotal		Browse
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	Virustotal		Browse
http://www.hardcodet.net/taskbar	0%	Virustotal		Browse
https://scripts.sil.org/OFL	0%	Virustotal		Browse
https://github.com/dotnet/corefx/tree/7601f4f6225089ff	0%	Virustotal		Browse
http://schemas.datacontract.org/2004/07/System.ServiceProcess	0%	Virustotal		Browse
https://vovsoft.com/files/batch-url-downloader.exe	0%	Virustotal		Browse
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	0%	Virustotal		Browse
https://www.fastestvpn.com/	0%	Virustotal		Browse
http://signalr.net/	0%	Virustotal		Browse
https://in.appcenter.ms./logs?api-version=1.0.0	0%	Virustotal		Browse
http://wpfanimatedgif.codeplex.com	1%	Virustotal		Browse
https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuer	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/www	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://Passport.NET/tb_	0%	Virustotal		Browse
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	0%	Virustotal		Browse
https://account.live.com/msangcwam	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd//www	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://www.google.com/bot.html)	0%	Virustotal		Browse
https://login.li	0%	Virustotal		Browse
https://github.com/hardcodet/wpf-notifyicon	0%	Virustotal		Browse
http://passport.net/tb	0%	Virustotal		Browse
http://crl.entrust.net/ts2ca.crl0	0%	Virustotal		Browse
http://vovsoft.com/openU	0%	Virustotal		Browse
http://crl.entrust.net/g2ca.crl0	0%	Virustotal		Browse
https://github.com/ericsink/SQLitePCL.raw	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
benchillppwo.shop	true	22%, Virustotal, Browse	unknown
answerrsdo.shop	true		unknown
affecthorsedpo.shop	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://vovsoft.com/blog/how-to-activate-using-license-key/openU	ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/09/policyce	svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.vmware.com/0	more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	false	URL Reputation: safe	unknown
http://schemas.datacontract.org	FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	false	0%, Virustotal, Browse	unknown
https://vovsoft.com/files/batch-url-downloader.exe	ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.indyproject.org/	ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2481847966.0000000002850000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fastestvpn.com/terms-of-service?device=windows	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	false	1%, Virustotal, Browse	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3CC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://vovsoft.com/files/text-edit-plus.exe	ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.datacontract.org/2004/07/System.ServiceProcess	FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2691554548.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hardcodet.net/taskbar	FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp	false	0%, Virustotal, Browse	unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	FastestVPN.exe, 0000001D.00000002.3396738823.000000000B3CC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/dotnet/corefx/tree/7601f4f6225089ff	FastestVPN.exe	false	0%, Virustotal, Browse	unknown
https://scripts.sil.org/OFL	FastestVPN.exe, 0000001D.00000002.3387714719.0000000008C12000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.fastestvpn.com/	OqAVRCkQ3T.exe, 00000000.00000003.2909012937.0000000002216000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2061980537.0000000002730000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2068491533.00000000033A0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.remobjects.com/ps	OqAVRCkQ3T.exe, 00000000.00000003.2063529817.0000000002730000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2064192255.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2065963797.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.innosetup.com/	OqAVRCkQ3T.exe, 00000000.00000003.2063529817.0000000002730000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.exe, 00000000.00000003.2064192255.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000000.2065963797.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://signalr.net/	FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp	false	0%, Virustotal, Browse	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuer	svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://in.appcenter.ms./logs?api-version=1.0.0	FastestVPN.exe, 0000001D.00000002.3391817656.000000000B122000.00000002.00000001.01000000.00000030.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2610109874.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wpfanimatedgif.codeplex.com	FastestVPN.exe, 0000001D.00000000.2537268642.000000000076D000.00000002.00000001.01000000.0000000D.sdmp, FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3370837677.0000000005E82000.00000002.00000001.01000000.00000021.sdmp	false	1%, Virustotal, Browse	unknown
http://Passport.NET/tb_	svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000024.00000002.2610109874.0000000004DA3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd/www	svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000024.00000002.2610109874.0000000004DA3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.entrust.net/rpa03	OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	false	URL Reputation: safe	unknown
http://www.google.com/bot.html)	ComDebug.exe, 00000005.00000002.2481847966.000000000287D000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore6lBcq	powershell.exe, 00000024.00000002.2610109874.0000000004C51000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://login.li	svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://account.live.com/msangcwam	svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590826566.000001A034157000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/Icon	powershell.exe, 00000024.00000002.2658087565.0000000005CB8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.w3.or	svchost.exe, 0000002A.00000003.2689083903.000001A034107000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.ver)	svchost.exe, 00000028.00000002.3312496939.0000020070600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310591981.000001A0338DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2610849451.000001A0338E5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://passport.net/tb	svchost.exe, 0000002A.00000002.3310381586.000001A0338B2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.symauth.com/cps0(	more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000024.00000002.2610109874.0000000004DA3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd//www	svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.symauth.com/rpa00	more.com, 0000000D.00000002.2674557354.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, SearchIndexer.exe, 0000002B.00000002.2743343688.000000000507A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/hardcodet/wpf-notifyicon	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360899456.0000000005B12000.00000002.00000001.01000000.0000001F.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	FastestVPN.exe, 0000001D.00000002.3320854485.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000002A.00000002.3311336772.000001A03415F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310591981.000001A0338DF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2592837643.000001A034132000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/ericsink/SQLitePCL.raw	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, FastestVPN.exe, 0000001D.00000002.3404635413.000000000BD82000.00000002.00000001.01000000.00000032.sdmp, FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr, is-3M67B.tmp.2.dr	false	0%, Virustotal, Browse	unknown
http://crl.entrust.net/ts2ca.crl0	OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3381816238.00000000088EE000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2784170132.0000000000907000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	false	0%, Virustotal, Browse	unknown
http://vovsoft.com/openU	ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.entrust.net/g2ca.crl0	OqAVRCkQ3T.tmp, 00000002.00000002.2894138555.000000000018C000.00000004.00000010.00020000.00000000.sdmp, OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 0000001D.00000002.3390686545.000000000AF90000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2793892279.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, is-SA7LQ.tmp.2.dr, is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-O947P.tmp.2.dr, is-TKLHN.tmp.2.dr, is-69FAA.tmp.2.dr, is-AJ7UA.tmp.2.dr, is-3M67B.tmp.2.dr, is-DFAQV.tmp.2.dr, is-RSP45.tmp.2.dr	false	0%, Virustotal, Browse	unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfen	svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	false	URL Reputation: safe	unknown
http://www.openssl.org/V	is-TQ205.tmp.2.dr	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdithm	svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ip-api.com/json	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3360030977.0000000005952000.00000002.00000001.01000000.0000001E.sdmp	false	URL Reputation: safe	unknown
https://fastestvpn.com/privacy-policy	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000002A.00000003.2590904638.000001A034163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.datacontract.org/2004/07/System.ServiceProcessd	FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	is-TQ205.tmp.2.dr, is-QAEOR.tmp.2.dr, is-TKLHN.tmp.2.dr, is-DFAQV.tmp.2.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000002A.00000002.3310150888.000001A03385F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590853728.000001A034140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/STS	svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/support/faq.html	is-TQ205.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/dotnet/runtime	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3357098503.0000000005872000.00000002.00000001.01000000.00000017.sdmp, FastestVPN.exe, 0000001D.00000002.3357302797.0000000005882000.00000002.00000001.01000000.00000016.sdmp, FastestVPN.exe, 0000001D.00000002.3320296929.0000000002C62000.00000002.00000001.01000000.00000015.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vovsoft.com/	ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://help.yahoo.com/help/us/ysearch/slurp)	ComDebug.exe, 00000005.00000002.2481847966.0000000002821000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2481847966.0000000002892000.00000004.00001000.00020000.00000000.sdmp, ComDebug.exe, 00000005.00000002.2483779713.0000000004DEC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	is-NP4VA.tmp.2.dr	false	URL Reputation: safe	unknown
http://www.w3.o	svchost.exe, 0000002A.00000002.3310670857.000001A033902000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000030.00000002.2795657527.00000000027F5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srfie	svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://Passport.NET/tb	svchost.exe, 0000002A.00000003.2731702082.000001A03480D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690026448.000001A03417A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692733625.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730686541.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692070040.000001A034B17000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2678333348.000001A034158000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000002A.00000002.3311490497.000001A034182000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2703023136.000001A034169000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738709577.000001A034183000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730944129.000001A034130000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000002A.00000003.2690974768.000001A03416A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://signup.live.com/signup.aspx	svchost.exe, 0000002A.00000003.2590783705.000001A03413B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A03412C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/JamesNK/Newtonsoft.Json	OqAVRCkQ3T.tmp, 00000002.00000003.2853443162.0000000005370000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3372638625.0000000005F62000.00000002.00000001.01000000.00000022.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdOAPF	svchost.exe, 0000002A.00000003.2738784677.000001A034174000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2738742010.000001A034169000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/signalr-core-differences	is-EAFR9.tmp.2.dr	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 0000002A.00000002.3311238898.000001A034137000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000002A.00000003.2591244354.000001A034156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590178501.000001A034129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2590607947.000001A034152000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds-cbc	svchost.exe, 0000002A.00000003.2717075690.000001A034176000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/ericsink/SQLitePCL.rawX	FastestVPN.exe, 0000001D.00000002.3405990710.000000000BDD2000.00000002.00000001.01000000.00000033.sdmp, is-O947P.tmp.2.dr	false		unknown
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 0000002A.00000002.3310110110.000001A033847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vovsoft.com/help/	ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vovsoft.comopenU	ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.google.com/bot.html)Mozilla/5.0	ComDebug.exe, 00000005.00000002.2481144877.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://vovsoft.comopenS	ComDebug.exe, 00000005.00000000.2449696560.0000000000401000.00000020.00000001.01000000.00000008.sdmp, ComDebug.exe, 00000005.00000002.2483779713.00000000048DD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fastestvpn.com/faq?device=windows	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3358887497.00000000058E2000.00000002.00000001.01000000.0000001A.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 0000002A.00000003.2731702082.000001A03480D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692733625.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2730686541.000001A034130000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2692070040.000001A034B17000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/ericsink/SQLitePCL.rawH	FastestVPN.exe, 0000001D.00000002.3406326857.000000000BDF2000.00000002.00000001.01000000.00000034.sdmp, is-3M67B.tmp.2.dr	false		unknown
https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc	FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000023.00000002.2768762487.0000000005232000.00000002.00000001.01000000.00000024.sdmp, is-EAFR9.tmp.2.dr	false		unknown
https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac73275	FastestVPN.exe, FastestVPN.exe, 0000001D.00000002.3407400191.000000000BE72000.00000002.00000001.01000000.00000035.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000028.00000003.2578366557.0000020070513000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524835
Start date and time:	2024-10-03 10:21:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OqAVRCkQ3T.exe renamed because original name is a hash value
Original Sample Name:	649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9.exe
Detection:	MAL
Classification:	mal64.troj.spyw.evad.winEXE@83/332@0/1
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 111 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 40.126.27.66, 20.190.155.1, 20.190.155.131, 20.190.155.67, 20.190.155.65, 20.190.155.130, 20.190.155.66, 20.190.155.2, 184.28.90.27, 20.189.173.20
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, cacerts.digicert.com, www.tm.v4.a.prd.aadg.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ocsps.ssl.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 3792 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:23:28	API Interceptor	1x Sleep call for process: ComDebug.exe modified
04:23:36	API Interceptor	2x Sleep call for process: more.com modified
04:23:38	API Interceptor	2x Sleep call for process: svchost.exe modified
04:23:38	API Interceptor	9x Sleep call for process: powershell.exe modified
04:23:50	API Interceptor	1x Sleep call for process: FastestVPN.exe modified
04:23:54	API Interceptor	2x Sleep call for process: WerFault.exe modified
10:23:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	mapMd1URzq.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	mnFHs2DuKg.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://email.mg.pmctraining.com/c/eJwkkcuSojAUhp_muJOKJyHAgoXTyMw41lxaa9TepZNwkUvoEER8-i7o3Vf5_tS5qVhRobla6XgTYBCSaMP9VRFHAWWMaKZYqJifqSALMoEkyiiXWvBsVcZaCn-jwmCtA63XQaTFmoVhuNZSURVo5RPCgJEm97pGOivKtmxzT5pmVceFc10PdAuYAqbjOHq5MXmtPWm8oQJMB1sDTT-AJqz9rc_hMPwrt93h9id50qkA5FY6oMnlyEiJ-zFZQtMkT4C8F0ATB8h1byXQL5fmu5cteUx9uGswPcwxM1ipgSaAXKr5y5GfwtqEw05apk_lGF1-zE7M8tL9rZJs_1WwTvb_j-QKyO96lo9bW7n6w07X8_j289urze-_APkgliZnmsdJRNMB-pjWMhN9UZrWWd2qft7J8l6Zyiyw3-TiuJAUnZOFWBgwvZ4fncRoODRdcUW3VU39FJfX5xUj8v49Hd5e_Ns7EqDJysaiLnvTejchK2DkXval66VxtWjVcoZ7jJ8BAAD__0X-oIk	Get hash	malicious	Unknown	Browse	192.229.221.95
	oRdgOQMxjr.exe	Get hash	malicious	RedLine	Browse	192.229.221.95
	https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.au	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://ryo-blog-for-life.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://akbb.kampanyakrediiislemleri.com/	Get hash	malicious	Unknown	Browse	192.229.221.95

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)	mapMd1URzq.exe	Get hash	malicious	Unknown	Browse
	mnFHs2DuKg.exe	Get hash	malicious	Unknown	Browse
	External.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse
	newvideozones.click.ps1	Get hash	malicious	Unknown	Browse
	use_2024_t#U043e_#U043epen.zip	Get hash	malicious	Unknown	Browse
	JetBrains.dotPeek.2024.1.3.web.exe	Get hash	malicious	Unknown	Browse
	JetBrains.dotPeek.2024.1.3.web.exe	Get hash	malicious	Unknown	Browse
	EmbravaConnect.msi	Get hash	malicious	PrivateLoader	Browse
	lIoOSFYisn.exe	Get hash	malicious	Unknown	Browse
C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	mapMd1URzq.exe	Get hash	malicious	Unknown	Browse
C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)	mnFHs2DuKg.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3316968
Entropy (8bit):	6.532906510598102
Encrypted:	false
SSDEEP:	49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
MD5:	0CF454B6ED4D9E46BC40306421E4B800
SHA1:	9611AA929D35CBD86B87E40B628F60D5177D2411
SHA-256:	E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
SHA-512:	85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: mapMd1URzq.exe, Detection: malicious, Browse Filename: mnFHs2DuKg.exe, Detection: malicious, Browse Filename: External.exe, Detection: malicious, Browse Filename: newvideozones.click.ps1, Detection: malicious, Browse Filename: use_2024_t#U043e_#U043epen.zip, Detection: malicious, Browse Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse Filename: EmbravaConnect.msi, Detection: malicious, Browse Filename: lIoOSFYisn.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............\|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s,..%..(.... ....o.....o 0...Zo....t....o8(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............T....r...p.(O....o$....(......0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox.....( ...*V.(&.....}......}..

C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30888
Entropy (8bit):	6.550270680442998
Encrypted:	false
SSDEEP:	384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
MD5:	96D7E9527C5D8BDBA798F72B5FD9B94A
SHA1:	C9CE9813C74493084D6E3DDA37C35C8822CA381F
SHA-256:	6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
SHA-512:	BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: mapMd1URzq.exe, Detection: malicious, Browse Filename: mnFHs2DuKg.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N..............d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(......{...."..}......{...."..}....V.(......(......(.....0..7.........(....}.......}.......}......\|......(...+..\|....(......{...."..}......{...."..}......{...."..}......{...."..}......(......(......(......(.......(.....0..?.........(....}3......}4......}5......}2.....\|3.....(...+..\|3...(......0..7.........(....}#......}$......}".....\|#.....(...+..\|#...(....*..0..?.........(....}.......}

C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.23750269831583
Encrypted:	false
SSDEEP:	1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
MD5:	0F7D6DEE75C3FBB958529AB6A351CBDF
SHA1:	1CA639AB692ECD972C51C8BF826BF9BF089359FE
SHA-256:	C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
SHA-512:	58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19112
Entropy (8bit):	6.821071301483957
Encrypted:	false
SSDEEP:	384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
MD5:	64E2269D156CA2AA5704E2E0908506F9
SHA1:	0F7D6EECE52D8A9A91E389736BE1092739AA3014
SHA-256:	B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
SHA-512:	C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ......`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~.............s......s......0..B.......(....,.s....(....(....(....(....(....(.....(....(....(.....(......(...+F.(...+(...+(...+F.(...+(...+(...+F.(...+(...+(...+.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+..(...+...0...........-......8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.623350319992477
Encrypted:	false
SSDEEP:	384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
MD5:	D92BF2C8E0A192E18B1F0B24CCB75171
SHA1:	2A6343C3409172E1D426B763151E0CBA3B35E473
SHA-256:	BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
SHA-512:	71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:.............,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....^~....-.s.........~......{...."..}......{...."..}......0..8........(........(.....(.....o....r...p(....o.......&..r...p.........--.......0..(.......(.....o........(.....(.......&..r...p..................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2...0..V...

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29352
Entropy (8bit):	6.56368110636982
Encrypted:	false
SSDEEP:	768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
MD5:	1CFBF0CBA3C87653D9639ADA438C3291
SHA1:	07E36A34319EAD85857CC022E277B69EA132750B
SHA-256:	3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
SHA-512:	E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H.............\|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....:.(......}......0..)........u..........,.(.....{.....{....o......v .5Q' )UU.Z(.....{....o....X..0..:........r...p......%..{.......%q.........-.&.+.......o.....(......{....:.(......}........0..)........u..........,.(.....{.....{....o......v . .q )UU.Z(.....{....o....X..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(......{......{....V.(......}......}.....0..A.......

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	6.761472837087098
Encrypted:	false
SSDEEP:	384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
MD5:	12A69C58D97C26D0132D493111E42345
SHA1:	0DCC8570C7D76B660746A0F657607864F8764AD4
SHA-256:	E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
SHA-512:	3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."......`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0../.........(....}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(....6..(...+(......(......(......{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.059106104983516
Encrypted:	false
SSDEEP:	24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
MD5:	66373624F8B60F41B8FEC0E61779C0AC
SHA1:	0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
SHA-256:	FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
SHA-512:	74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124072
Entropy (8bit):	6.169344446608534
Encrypted:	false
SSDEEP:	3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
MD5:	2DC3102392DAEF9B935CDF4939A9B132
SHA1:	F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
SHA-256:	B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
SHA-512:	596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}......}......{......{......{......{......{....J.......s!...s:....~....%-.&~..........s!...%.....s:...J.......s"...s#...J.......s!...s:.....0..........(...+o$.....E........9...^...*.r...pr...pr..

C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:	12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\FastestVPN.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2059432
Entropy (8bit):	7.651137710710665
Encrypted:	false
SSDEEP:	24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
MD5:	01CF6EF766C41BB2C99A2CCCDECC69C1
SHA1:	8DD5EB983C1C8F2E3A2538E50295644BB778A69E
SHA-256:	9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
SHA-512:	9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B.................8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(.......(......{...."..}......{...."..}......{...."..}......{...."..}.......(.......(....(.......(....(.......(....(......0..5........('...-...((.....o)...(...(+...(,.......,..o-.................)........(....2.(/...o0.....(1....(2...2.(....o3.....(....o4...&.(.....o5....(.....o5....(....o6...&2.(....o7

C:\Program Files\FastestVPN\FastestVPN.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.030466366630491
Encrypted:	false
SSDEEP:	24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
MD5:	B94AE93769D64791440B3C36CC82AC69
SHA1:	E4AAAD9A0FB51051C8B25F768BC1563543F132C0
SHA-256:	432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
SHA-512:	AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

C:\Program Files\FastestVPN\Flurl.Http.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117928
Entropy (8bit):	6.160360774488817
Encrypted:	false
SSDEEP:	3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
MD5:	FDFDFE021B53B630939D27C6C90CB435
SHA1:	AA0987A6EA6987BB9930B9167EC31C249EF9D885
SHA-256:	D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
SHA-512:	1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O......................................T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...>..su...%.}^......0...........(+...,.....(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

C:\Program Files\FastestVPN\Flurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49320
Entropy (8bit):	6.325351798150663
Encrypted:	false
SSDEEP:	768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
MD5:	C22900453EF4B917460ADEA7DE87225B
SHA1:	6878237656DA68C046FB95FAA8CAF3B4C719851B
SHA-256:	9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
SHA-512:	2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,..............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{".....{#...V.($.....}".....}#......0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...... ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o...X...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,.....{-.....{....V.($.....}-.....}.....0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...... (... )UU.

C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108200
Entropy (8bit):	7.332504567097915
Encrypted:	false
SSDEEP:	1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
MD5:	261A5044C94F318DEEA20D178ED9F36E
SHA1:	2A9704F70A543EE219481A3AA756A0CF151E1999
SHA-256:	D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
SHA-512:	E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................\|.................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..\|w..................,.......................................V!.)1......s............0..$........u......,...o.....u......,...o.....0..&........u......,....o ....u......,....o!......0..&........u......,....o"....u......,....o#...B.(Y...-.(.......{!..."..}!...>.{....o........0..9........(.....($.....(......,..o%...-..,..o&...-..,..o%.....*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25976
Entropy (8bit):	6.331152456306087
Encrypted:	false
SSDEEP:	384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
MD5:	3C5DFBB4E3F1AD153EB2E203B56EA0AE
SHA1:	59623BF1D67D87264C165E421F12426DA998AF46
SHA-256:	9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
SHA-512:	94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(.....0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53624
Entropy (8bit):	6.18841715621451
Encrypted:	false
SSDEEP:	768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
MD5:	B7ABAF6A90E95E585E71C0C22D90AF73
SHA1:	C9756883D1738A9931D0BF58D6F69CBB8DFD5870
SHA-256:	3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
SHA-512:	3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....2.r...p(....V.(......}......}......{......{......{......(......}......}......}.......}.......}......{......{......{......{......{.......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...

C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	147848
Entropy (8bit):	6.032707503792338
Encrypted:	false
SSDEEP:	3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
MD5:	B6DB385295FA78A6AABCF217FD3C3F83
SHA1:	71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
SHA-256:	ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
SHA-512:	122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X.....rS..po%...,.r[..prg..p(X....~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((............U.E........(....*.

C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149896
Entropy (8bit):	6.136390335470081
Encrypted:	false
SSDEEP:	1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
MD5:	70B1C15FDBBFB88F91965DC7BBC5527F
SHA1:	A473571DAC42819933CD7EF0C604F1EA0614D2F3
SHA-256:	109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
SHA-512:	C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+.~.....~.....~......%-.&(......%-.&~ .......0..........(!......o"......(7..........................0..........(!......o...+...(...+........................~$...%-.&~%.....&...s'...%.$....(...+.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+..0..9.......s......}+.....},.....}-................s/... ....(B...&....0..$........,...r...p......%.....o~......o0...*

C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26752
Entropy (8bit):	6.512503595653532
Encrypted:	false
SSDEEP:	768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
MD5:	970B6E6478AE3AB699F277D77DE0CD19
SHA1:	5475CB28998D419B4714343FFA9511FF46322AC2
SHA-256:	5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
SHA-512:	F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P..................,R........................................(......(....^.(.......1...%...}....:.(......}....:.(......}....:.(......}....:.(......}......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(.......2...%...}....:.(......}......{....z.(......}.......2...%...}....V.(......}......}......{......{....:.(......}......{......{...."..}......{...."..}......{

C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48256
Entropy (8bit):	6.234996524588368
Encrypted:	false
SSDEEP:	768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
MD5:	37EB7CCE6E282D3572D64C880E1AC3C8
SHA1:	9A2952589A19D650932E7C633577EB9AFC04F959
SHA-256:	039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
SHA-512:	E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(......(....^.(.......>...%...}....:.(......}....:.(......}....:.(......}....:.(......}....*.-..(......s....z.~.......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......( ....(....,.r...p......%...%...%...(.......(!....(....,!r...p......%...%...%...%...(........(".....,&(....,..r...pr...p.(....(#.....($.....(.

C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88192
Entropy (8bit):	6.25584016939133
Encrypted:	false
SSDEEP:	1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
MD5:	4186A905DC180A0CC2110403727BD792
SHA1:	E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
SHA-256:	40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
SHA-512:	1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(......(....^.(.......k...%...}....:.(......}....:.(......}....:.(......}....:.(......}.....~......0..........(....,....(.....o ......&......................0...........(.......(!...-..,....(....,.r...p......%...%...(".....(#....(....,.r...p......%...%...%...("......($....(....,!r...p......%...%...%...%...(".......(%.....,&(....,..r...pr...p.("...(&.....('....*.(....,.r...p......%...

C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\Resources\ComDebug.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	196157514
Entropy (8bit):	0.9790898435836601
Encrypted:	false
SSDEEP:	196608:hqw2hVGlR9fHUTW9kG0Pktx+PSRFZyqMpBeD63RmTtGtqQY6lgJTXdrb4acJ7AuN:hohVgRxmP8k
MD5:	F892887D8532D19F74884CDC48B1AC8B
SHA1:	BD20AFCD00D7C5A46CC1C5399BDC15A185F815D3
SHA-256:	2E7FA00A4C0EA04EF0ABCD658BDE323DB0FDFFCA1C5402592CB2197EE3126383
SHA-512:	7A610425A58C24815D6731C04BBD2DC919799AE36D95184B567C3A86ED1733B542F7D5F523DF6E4577BB69D755100597E815815378A4F103232FAD7ACF2E9F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w..e..................P... ...... P......0P...@..........................pt.....CO....@......@...................PV.......V..=...p].................`(....V..............................pV.......................V......@V......................text...D.O.......O................. ..`.itext...1....O..2....O............. ..`.data...l....0P.......P.............@....bss....\0....R..........................idata...=....V..>....R.............@....didata......@V.......R.............@....edata.......PV.......R.............@..@.tls....\....`V..........................rdata..]....pV.......R.............@..@.reloc........V.......R.............@..B.rsrc........p].......Y.............@..@..............d......>a.............@..@................

C:\Program Files\FastestVPN\Resources\Setup.Ps1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.09733291062762
Encrypted:	false
SSDEEP:	6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
MD5:	777B3CBF81DDD8B238BDEDDDEA17AFED
SHA1:	C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
SHA-256:	DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
SHA-512:	5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
Malicious:	false
Preview:	If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

C:\Program Files\FastestVPN\Resources\data\ca1.ca (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\ca2.ca (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\is-7G3MI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\data\is-NMBSC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\data\is-OVOMN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\is-SKNAP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	6.013187457463572
Encrypted:	false
SSDEEP:	48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
MD5:	94F25D41487F654EF2371FA92544003C
SHA1:	41A561AA773A21C240F74AF4F14DB7FB2479F630
SHA-256:	E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
SHA-512:	281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

C:\Program Files\FastestVPN\Resources\data\tcp.tls (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\data\udp.tls (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.532694766524299
Encrypted:	false
SSDEEP:	12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
MD5:	005BF2A1B29FB74EF9ED7402A69D5CD5
SHA1:	ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
SHA-256:	F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
SHA-512:	381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
Malicious:	false
Preview:	-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

C:\Program Files\FastestVPN\Resources\devcon.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.48517352660103
Encrypted:	false
SSDEEP:	1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
MD5:	A2ADF4897942B99FE0738F8C37FD15C0
SHA1:	4192A2221F5C48A16427BF1898C0443CA27A29BB
SHA-256:	B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
SHA-512:	DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.3985610361996965
Encrypted:	false
SSDEEP:	6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
MD5:	259CE13E63C08F5198A5D7337DCCC0C0
SHA1:	E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
SHA-256:	CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
SHA-512:	AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
Malicious:	false
Preview:	@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

C:\Program Files\FastestVPN\Resources\driver\is-KSP41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.3909078265911585
Encrypted:	false
SSDEEP:	6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
MD5:	6D857A141F9C245E6ACD7012120A0704
SHA1:	66666950BDB2486C58B1C2D11132A98BF3A54EA8
SHA-256:	992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
SHA-512:	8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
Malicious:	false
Preview:	@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

C:\Program Files\FastestVPN\Resources\driver\is-OIO4P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.3985610361996965
Encrypted:	false
SSDEEP:	6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
MD5:	259CE13E63C08F5198A5D7337DCCC0C0
SHA1:	E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
SHA-256:	CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
SHA-512:	AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
Malicious:	false
Preview:	@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

C:\Program Files\FastestVPN\Resources\driver\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.3909078265911585
Encrypted:	false
SSDEEP:	6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
MD5:	6D857A141F9C245E6ACD7012120A0704
SHA1:	66666950BDB2486C58B1C2D11132A98BF3A54EA8
SHA-256:	992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
SHA-512:	8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
Malicious:	false
Preview:	@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-32KE2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-5RGR2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-74SDR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-INGVK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	507728
Entropy (8bit):	6.351404653031349
Encrypted:	false
SSDEEP:	3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
MD5:	E313336C82EB265542664CC7A360C5FF
SHA1:	184211A456E09AC606DB76F814332CC912C0F5EB
SHA-256:	B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
SHA-512:	F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-JDOCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-PU5N8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:	192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:	768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	507728
Entropy (8bit):	6.351404653031349
Encrypted:	false
SSDEEP:	3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
MD5:	E313336C82EB265542664CC7A360C5FF
SHA1:	184211A456E09AC606DB76F814332CC912C0F5EB
SHA-256:	B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
SHA-512:	F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-0PS85.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-7CFS6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-CDPP5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	7.241389894622462
Encrypted:	false
SSDEEP:	192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
MD5:	6A3C291EB986A23B427ECF92779C6902
SHA1:	C96B9791A0F5AC27F84E2F3E06E64C8513168477
SHA-256:	C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
SHA-512:	1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
Malicious:	false
Preview:	0.n...H........_0.[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....\|s6...xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....\|s6..*.xV. .,...e0..a0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-E3JOD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35008
Entropy (8bit):	6.574406479237283
Encrypted:	false
SSDEEP:	768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
MD5:	77E134EBCD2C8EA7D217EBD61DAAA7B6
SHA1:	F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
SHA-256:	CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
SHA-512:	57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-GTT7V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396840
Entropy (8bit):	6.504700092936786
Encrypted:	false
SSDEEP:	12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
MD5:	D680D27DCC19546B721F731384EE56DD
SHA1:	B418C1B8CB5E8259F9C8CBED29676AD101A15425
SHA-256:	E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
SHA-512:	B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-HUQLV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10866
Entropy (8bit):	7.241389894622462
Encrypted:	false
SSDEEP:	192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
MD5:	6A3C291EB986A23B427ECF92779C6902
SHA1:	C96B9791A0F5AC27F84E2F3E06E64C8513168477
SHA-256:	C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
SHA-512:	1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
Malicious:	false
Preview:	0.n...H........_0.[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....\|s6...xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....\|s6..*.xV. .,...e0..a0....+.

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35008
Entropy (8bit):	6.574406479237283
Encrypted:	false
SSDEEP:	768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
MD5:	77E134EBCD2C8EA7D217EBD61DAAA7B6
SHA1:	F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
SHA-256:	CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
SHA-512:	57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396840
Entropy (8bit):	6.504700092936786
Encrypted:	false
SSDEEP:	12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
MD5:	D680D27DCC19546B721F731384EE56DD
SHA1:	B418C1B8CB5E8259F9C8CBED29676AD101A15425
SHA-256:	E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
SHA-512:	B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows10\i386\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-48IDT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	7.139091215265505
Encrypted:	false
SSDEEP:	192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
MD5:	685D08D5E2A2450648A40B518E2046FC
SHA1:	D99E38968DE1CA1850971A2B81BFDAB49626AAED
SHA-256:	56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
SHA-512:	619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
Malicious:	false
Preview:	0.'6...H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-GOJKM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39384
Entropy (8bit):	6.220766637489946
Encrypted:	false
SSDEEP:	768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
MD5:	2CCA8DC5DA7F197C8C97A2EEBCBFA908
SHA1:	1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
SHA-256:	AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
SHA-512:	AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-J4FPP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-ON3RQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	498504
Entropy (8bit):	6.313132779768202
Encrypted:	false
SSDEEP:	3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
MD5:	F19CFFFF76FF48E98F060A563DD8345B
SHA1:	C77F3FE9FFBA02DE288661FBB66656791196EDBC
SHA-256:	16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
SHA-512:	0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-PVM3P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-RVBPK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10042
Entropy (8bit):	7.139091215265505
Encrypted:	false
SSDEEP:	192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
MD5:	685D08D5E2A2450648A40B518E2046FC
SHA1:	D99E38968DE1CA1850971A2B81BFDAB49626AAED
SHA-256:	56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
SHA-512:	619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
Malicious:	false
Preview:	0.'6...H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39384
Entropy (8bit):	6.220766637489946
Encrypted:	false
SSDEEP:	768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
MD5:	2CCA8DC5DA7F197C8C97A2EEBCBFA908
SHA1:	1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
SHA-256:	AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
SHA-512:	AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	498504
Entropy (8bit):	6.313132779768202
Encrypted:	false
SSDEEP:	3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
MD5:	F19CFFFF76FF48E98F060A563DD8345B
SHA1:	C77F3FE9FFBA02DE288661FBB66656791196EDBC
SHA-256:	16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
SHA-512:	0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.]..........".........d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....)......................... ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\amd64\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\i386\OemVista.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\i386\install_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3LE8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	387400
Entropy (8bit):	6.458236487570103
Encrypted:	false
SSDEEP:	6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
MD5:	46F33BBA03FF35C0A777B5875E832559
SHA1:	C4B5487307DB1B715EDA5C233DBD346EF44ABF02
SHA-256:	72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
SHA-512:	7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-3U4F4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-6JP0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7533
Entropy (8bit):	5.046821594517318
Encrypted:	false
SSDEEP:	192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
MD5:	3A541F2BF9842CDE6F0C95E83DE14FFA
SHA1:	12C074F03AA19968893F2BE48FDEF42A293B7EE4
SHA-256:	598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
SHA-512:	F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-CL5M9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34264
Entropy (8bit):	6.451114076364161
Encrypted:	false
SSDEEP:	384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
MD5:	EF55CAAABD0E13C304587D941C343F77
SHA1:	F0E323EF510E00FC925A7FB37C625D077FECA8A3
SHA-256:	A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
SHA-512:	D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-DHPIR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.832057381123706
Encrypted:	false
SSDEEP:	6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
MD5:	939DFFC36D36E4C85EE6703C812987E5
SHA1:	3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
SHA-256:	843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
SHA-512:	8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FJ6LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10010
Entropy (8bit):	7.143392930093258
Encrypted:	false
SSDEEP:	192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
MD5:	BEE546D1A9EE2F74F4C9B0A347DBAB7C
SHA1:	BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
SHA-256:	DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
SHA-512:	B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
Malicious:	false
Preview:	0.'....H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	data
Category:	dropped
Size (bytes):	10010
Entropy (8bit):	7.143392930093258
Encrypted:	false
SSDEEP:	192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
MD5:	BEE546D1A9EE2F74F4C9B0A347DBAB7C
SHA1:	BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
SHA-256:	DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
SHA-512:	B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
Malicious:	false
Preview:	0.'....H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34264
Entropy (8bit):	6.451114076364161
Encrypted:	false
SSDEEP:	384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
MD5:	EF55CAAABD0E13C304587D941C343F77
SHA1:	F0E323EF510E00FC925A7FB37C625D077FECA8A3
SHA-256:	A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
SHA-512:	D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	387400
Entropy (8bit):	6.458236487570103
Encrypted:	false
SSDEEP:	6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
MD5:	46F33BBA03FF35C0A777B5875E832559
SHA1:	C4B5487307DB1B715EDA5C233DBD346EF44ABF02
SHA-256:	72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
SHA-512:	7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\driver\windows\i386\uninstall_tap.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.838122400792552
Encrypted:	false
SSDEEP:	3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
MD5:	012961E4DD4402DA78BC174AF09B77F9
SHA1:	900CA53983FAA217DD134664A9E694138E9A6FDF
SHA-256:	E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
SHA-512:	332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

C:\Program Files\FastestVPN\Resources\is-0GCGM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	244360
Entropy (8bit):	6.534833630270433
Encrypted:	false
SSDEEP:	6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
MD5:	92CAE75041DFA888EE8284E7C6BB658E
SHA1:	2632FD77EAEDC09977192CFAA19EAEE66F538041
SHA-256:	ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
SHA-512:	F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-1J41S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68744
Entropy (8bit):	6.03232541602541
Encrypted:	false
SSDEEP:	1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
MD5:	41E94A80206A87D947CE6CF5823494BE
SHA1:	558214579EE8F2732C36F779E545BA1340191E49
SHA-256:	E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
SHA-512:	54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...\|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-7CHS6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	178552
Entropy (8bit):	6.1636094237053305
Encrypted:	false
SSDEEP:	3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
MD5:	3D0E093C2EA9BE7460BFBAD86E6FBB58
SHA1:	C36EB5601DF523DE321146CF1853F899921AB519
SHA-256:	810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
SHA-512:	CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............\|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-92POB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8184456
Entropy (8bit):	6.15917051663501
Encrypted:	false
SSDEEP:	98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
MD5:	5850A25689FA1B36CD6B76E2E7F6BDB3
SHA1:	299CEBD4CD448239BF5094DCC0632100287C0B85
SHA-256:	803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
SHA-512:	F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.\|.... d.t.............\|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..\|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-9AF3F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.0491979415178765
Encrypted:	false
SSDEEP:	6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
MD5:	C8768E552ABCA40175C704E4AF1F030C
SHA1:	7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
SHA-256:	50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
SHA-512:	09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
Malicious:	false
Preview:	OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

C:\Program Files\FastestVPN\Resources\is-DQ0IA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	918536
Entropy (8bit):	6.038516348303836
Encrypted:	false
SSDEEP:	12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
MD5:	6F1B7C24C5FF662F4364B323F42C101A
SHA1:	B74949B7A809F8139BD89BD5B96E230108A6615D
SHA-256:	034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
SHA-512:	B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

C:\Program Files\FastestVPN\Resources\is-E834D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3490952
Entropy (8bit):	6.105770368598401
Encrypted:	false
SSDEEP:	49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
MD5:	474D774A60BCBDBB326C248D1B86C785
SHA1:	C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
SHA-256:	4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
SHA-512:	D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.\|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...\|.....5.......4.............@..@.reloc...z... 5..\|....4.............@..B................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-H0796.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.485112927422894
Encrypted:	false
SSDEEP:	1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
MD5:	8E7EE7C3876683902475753519681407
SHA1:	75FACB7F9C59B284F97956E799E57FB0F606C49D
SHA-256:	6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
SHA-512:	523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-HQ1IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27784
Entropy (8bit):	6.488306745612165
Encrypted:	false
SSDEEP:	384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
MD5:	41C55E2A9D5D9B23C08E3DC067780DC7
SHA1:	1FB62C7FCF24F604676896121C1CCAFB628C1BE1
SHA-256:	D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
SHA-512:	396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........\|0..p...........................................6.(.....(.......0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o............#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o..............#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o................,7..........4?.......0..M.......~....s......o.....;.....

C:\Program Files\FastestVPN\Resources\is-I47CR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	585512
Entropy (8bit):	6.002108518534667
Encrypted:	false
SSDEEP:	12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
MD5:	2C700BBCDA59BFE2CD7EBF9BAA5B2626
SHA1:	72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
SHA-256:	C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
SHA-512:	0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m)..........t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@.....................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....\|...........................@..B/57..........0......................@.0B/70.....2....@..........

C:\Program Files\FastestVPN\Resources\is-IOEQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	700040
Entropy (8bit):	5.552155208041958
Encrypted:	false
SSDEEP:	12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
MD5:	6EE5C92E2918B27974086A6F24D79043
SHA1:	40595B75A513BBF1BE16780784E13EFDAD2E40C7
SHA-256:	86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
SHA-512:	F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P......>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-KLMTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776328
Entropy (8bit):	6.92032788063544
Encrypted:	false
SSDEEP:	12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
MD5:	6ECA26F16FEB505B1BD0A0A25DA4AEDB
SHA1:	297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
SHA-256:	CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
SHA-512:	78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..\|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...\|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-M395B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99976
Entropy (8bit):	6.499161413646961
Encrypted:	false
SSDEEP:	1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
MD5:	85054BAF6D0A7D31A18183ACC4CBA133
SHA1:	24830C002FFAB31102DFB674B52AFFD74E90E708
SHA-256:	EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
SHA-512:	B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-OE3IT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	196157514
Entropy (8bit):	0.9790898435836601
Encrypted:	false
SSDEEP:	196608:hqw2hVGlR9fHUTW9kG0Pktx+PSRFZyqMpBeD63RmTtGtqQY6lgJTXdrb4acJ7AuN:hohVgRxmP8k
MD5:	F892887D8532D19F74884CDC48B1AC8B
SHA1:	BD20AFCD00D7C5A46CC1C5399BDC15A185F815D3
SHA-256:	2E7FA00A4C0EA04EF0ABCD658BDE323DB0FDFFCA1C5402592CB2197EE3126383
SHA-512:	7A610425A58C24815D6731C04BBD2DC919799AE36D95184B567C3A86ED1733B542F7D5F523DF6E4577BB69D755100597E815815378A4F103232FAD7ACF2E9F67
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...w..e..................P... ...... P......0P...@..........................pt.....CO....@......@...................PV.......V..=...p].................`(....V..............................pV.......................V......@V......................text...D.O.......O................. ..`.itext...1....O..2....O............. ..`.data...l....0P.......P.............@....bss....\0....R..........................idata...=....V..>....R.............@....didata......@V.......R.............@....edata.......PV.......R.............@..@.tls....\....`V..........................rdata..]....pV.......R.............@..@.reloc........V.......R.............@..B.rsrc........p].......Y.............@..@..............d......>a.............@..@................

C:\Program Files\FastestVPN\Resources\is-PVULV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.09733291062762
Encrypted:	false
SSDEEP:
MD5:	777B3CBF81DDD8B238BDEDDDEA17AFED
SHA1:	C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
SHA-256:	DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
SHA-512:	5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
Malicious:	false
Preview:	If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

C:\Program Files\FastestVPN\Resources\is-Q5PL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.48517352660103
Encrypted:	false
SSDEEP:
MD5:	A2ADF4897942B99FE0738F8C37FD15C0
SHA1:	4192A2221F5C48A16427BF1898C0443CA27A29BB
SHA-256:	B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
SHA-512:	DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-QAA9O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42120
Entropy (8bit):	6.157445136592099
Encrypted:	false
SSDEEP:
MD5:	F6AFD5499FCC5D464085AD889BAE09B7
SHA1:	287C540655FCED0C09DDA2D9C4EADD3F3E210B17
SHA-256:	6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
SHA-512:	BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-QTAN0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89736
Entropy (8bit):	5.522767465825831
Encrypted:	false
SSDEEP:
MD5:	2CC3AC572A2170108BABD019F0BFE779
SHA1:	AF962245CE32D5801A380FF7F6B8C87AC7772AB2
SHA-256:	755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
SHA-512:	891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-SQ4JH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	865416
Entropy (8bit):	6.558002511161394
Encrypted:	false
SSDEEP:
MD5:	A151697A9F14639BFA2CB3E470CEA355
SHA1:	FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
SHA-256:	4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
SHA-512:	888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-STKUM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	113800
Entropy (8bit):	6.497871168162335
Encrypted:	false
SSDEEP:
MD5:	C966B6A5F0143199FF16F8E491E2B44D
SHA1:	A47ECE66964E5432551E782EC53EBFEA42845256
SHA-256:	EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
SHA-512:	54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......\|......\|......\|......\|.....P\|.....b............P\|.....P\|.....P\|.....P\|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\is-TQ205.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2276496
Entropy (8bit):	6.2839627604807955
Encrypted:	false
SSDEEP:
MD5:	A928351F9555A07B7A8DCEA6B209D367
SHA1:	66379948FB082D9EB390B77C4E00EFAD25062C9C
SHA-256:	8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
SHA-512:	099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...\|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

C:\Program Files\FastestVPN\Resources\is-UA1JD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94856
Entropy (8bit):	5.499392443352034
Encrypted:	false
SSDEEP:
MD5:	834EE5DA601A6C78C43C64F6C282682F
SHA1:	03920B402B787CA53CD79A66B0B611C899B91F3E
SHA-256:	754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
SHA-512:	C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3490952
Entropy (8bit):	6.105770368598401
Encrypted:	false
SSDEEP:
MD5:	474D774A60BCBDBB326C248D1B86C785
SHA1:	C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
SHA-256:	4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
SHA-512:	D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.\|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...\|.....5.......4.............@..@.reloc...z... 5..\|....4.............@..B................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2276496
Entropy (8bit):	6.2839627604807955
Encrypted:	false
SSDEEP:
MD5:	A928351F9555A07B7A8DCEA6B209D367
SHA1:	66379948FB082D9EB390B77C4E00EFAD25062C9C
SHA-256:	8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
SHA-512:	099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...\|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	178552
Entropy (8bit):	6.1636094237053305
Encrypted:	false
SSDEEP:
MD5:	3D0E093C2EA9BE7460BFBAD86E6FBB58
SHA1:	C36EB5601DF523DE321146CF1853F899921AB519
SHA-256:	810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
SHA-512:	CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............\|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	113800
Entropy (8bit):	6.497871168162335
Encrypted:	false
SSDEEP:
MD5:	C966B6A5F0143199FF16F8E491E2B44D
SHA1:	A47ECE66964E5432551E782EC53EBFEA42845256
SHA-256:	EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
SHA-512:	54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......\|......\|......\|......\|.....P\|.....b............P\|.....P\|.....P\|.....P\|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	700040
Entropy (8bit):	5.552155208041958
Encrypted:	false
SSDEEP:
MD5:	6EE5C92E2918B27974086A6F24D79043
SHA1:	40595B75A513BBF1BE16780784E13EFDAD2E40C7
SHA-256:	86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
SHA-512:	F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P......>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	244360
Entropy (8bit):	6.534833630270433
Encrypted:	false
SSDEEP:
MD5:	92CAE75041DFA888EE8284E7C6BB658E
SHA1:	2632FD77EAEDC09977192CFAA19EAEE66F538041
SHA-256:	ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
SHA-512:	F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776328
Entropy (8bit):	6.92032788063544
Encrypted:	false
SSDEEP:
MD5:	6ECA26F16FEB505B1BD0A0A25DA4AEDB
SHA1:	297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
SHA-256:	CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
SHA-512:	78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..\|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...\|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\openssl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	918536
Entropy (8bit):	6.038516348303836
Encrypted:	false
SSDEEP:
MD5:	6F1B7C24C5FF662F4364B323F42C101A
SHA1:	B74949B7A809F8139BD89BD5B96E230108A6615D
SHA-256:	034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
SHA-512:	B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	865416
Entropy (8bit):	6.558002511161394
Encrypted:	false
SSDEEP:
MD5:	A151697A9F14639BFA2CB3E470CEA355
SHA1:	FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
SHA-256:	4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
SHA-512:	888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68744
Entropy (8bit):	6.03232541602541
Encrypted:	false
SSDEEP:
MD5:	41E94A80206A87D947CE6CF5823494BE
SHA1:	558214579EE8F2732C36F779E545BA1340191E49
SHA-256:	E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
SHA-512:	54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...\|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27784
Entropy (8bit):	6.488306745612165
Encrypted:	false
SSDEEP:
MD5:	41C55E2A9D5D9B23C08E3DC067780DC7
SHA1:	1FB62C7FCF24F604676896121C1CCAFB628C1BE1
SHA-256:	D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
SHA-512:	396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........\|0..p...........................................6.(.....(.......0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o............#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o..............#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o................,7..........4?.......0..M.......~....s......o.....;.....

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77064
Entropy (8bit):	6.309512423177142
Encrypted:	false
SSDEEP:
MD5:	760475CD23CE23410F37558452B28545
SHA1:	68ED3626CE9ABE090B960EEB909C4324205DDEF0
SHA-256:	113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
SHA-512:	AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-NP4VA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77064
Entropy (8bit):	6.309512423177142
Encrypted:	false
SSDEEP:
MD5:	760475CD23CE23410F37558452B28545
SHA1:	68ED3626CE9ABE090B960EEB909C4324205DDEF0
SHA-256:	113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
SHA-512:	AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72304
Entropy (8bit):	6.723888135179154
Encrypted:	false
SSDEEP:
MD5:	5EE29684A6D1E66FD1590742620448EE
SHA1:	71DB43CA9730411BADD39AB2631A1346EF740AAA
SHA-256:	3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
SHA-512:	5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-KQVDN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72304
Entropy (8bit):	6.723888135179154
Encrypted:	false
SSDEEP:
MD5:	5EE29684A6D1E66FD1590742620448EE
SHA1:	71DB43CA9730411BADD39AB2631A1346EF740AAA
SHA-256:	3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
SHA-512:	5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-AIA31.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-L37FQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\install_sp.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	5.160291198458603
Encrypted:	false
SSDEEP:
MD5:	39B9357BA2B8B640ACFAE47275B80C56
SHA1:	0A80D68131736FB29C71D66CEBED9D59258F86DB
SHA-256:	76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
SHA-512:	D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" \| find /i "Windows 7" > NUL && set OS=windows7 \|\| set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

C:\Program Files\FastestVPN\Resources\sp\is-7URTB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	5.160291198458603
Encrypted:	false
SSDEEP:
MD5:	39B9357BA2B8B640ACFAE47275B80C56
SHA1:	0A80D68131736FB29C71D66CEBED9D59258F86DB
SHA-256:	76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
SHA-512:	D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" \| find /i "x86" > NUL && set ARCH=i386 \|\| set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" \| find /i "Windows 7" > NUL && set OS=windows7 \|\| set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

C:\Program Files\FastestVPN\Resources\sp\is-DHG8F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.487708026306449
Encrypted:	false
SSDEEP:
MD5:	2D0CB38D144B0F1A34BD6F715D697658
SHA1:	65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
SHA-256:	DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
SHA-512:	472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

C:\Program Files\FastestVPN\Resources\sp\release\is-9KLB3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61064
Entropy (8bit):	6.255909242219927
Encrypted:	false
SSDEEP:
MD5:	9333F583E2D32A47276DCEC7C2391FD2
SHA1:	8757F8136354B7F98407CEBFE8BDA6043972D88E
SHA-256:	AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
SHA-512:	922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...\|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\release\is-DFAQV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.430638214966169
Encrypted:	false
SSDEEP:
MD5:	E7C064693750D51F5AC901A0CF0A987A
SHA1:	0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
SHA-256:	6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
SHA-512:	12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0\|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.430638214966169
Encrypted:	false
SSDEEP:
MD5:	E7C064693750D51F5AC901A0CF0A987A
SHA1:	0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
SHA-256:	6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
SHA-512:	12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0\|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61064
Entropy (8bit):	6.255909242219927
Encrypted:	false
SSDEEP:
MD5:	9333F583E2D32A47276DCEC7C2391FD2
SHA1:	8757F8136354B7F98407CEBFE8BDA6043972D88E
SHA-256:	AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
SHA-512:	922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...\|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\sp\uninstall_sp.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.487708026306449
Encrypted:	false
SSDEEP:
MD5:	2D0CB38D144B0F1A34BD6F715D697658
SHA1:	65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
SHA-256:	DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
SHA-512:	472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
Malicious:	false
Preview:	@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	585512
Entropy (8bit):	6.002108518534667
Encrypted:	false
SSDEEP:
MD5:	2C700BBCDA59BFE2CD7EBF9BAA5B2626
SHA1:	72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
SHA-256:	C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
SHA-512:	0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m)..........t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@.....................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....\|...........................@..B/57..........0......................@.0B/70.....2....@..........

C:\Program Files\FastestVPN\Resources\status.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.0491979415178765
Encrypted:	false
SSDEEP:
MD5:	C8768E552ABCA40175C704E4AF1F030C
SHA1:	7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
SHA-256:	50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
SHA-512:	09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
Malicious:	false
Preview:	OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42120
Entropy (8bit):	6.157445136592099
Encrypted:	false
SSDEEP:
MD5:	F6AFD5499FCC5D464085AD889BAE09B7
SHA1:	287C540655FCED0C09DDA2D9C4EADD3F3E210B17
SHA-256:	6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
SHA-512:	BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94856
Entropy (8bit):	5.499392443352034
Encrypted:	false
SSDEEP:
MD5:	834EE5DA601A6C78C43C64F6C282682F
SHA1:	03920B402B787CA53CD79A66B0B611C899B91F3E
SHA-256:	754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
SHA-512:	C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89736
Entropy (8bit):	5.522767465825831
Encrypted:	false
SSDEEP:
MD5:	2CC3AC572A2170108BABD019F0BFE779
SHA1:	AF962245CE32D5801A380FF7F6B8C87AC7772AB2
SHA-256:	755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
SHA-512:	891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93832
Entropy (8bit):	5.485112927422894
Encrypted:	false
SSDEEP:
MD5:	8E7EE7C3876683902475753519681407
SHA1:	75FACB7F9C59B284F97956E799E57FB0F606C49D
SHA-256:	6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
SHA-512:	523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....\|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	99976
Entropy (8bit):	6.499161413646961
Encrypted:	false
SSDEEP:
MD5:	85054BAF6D0A7D31A18183ACC4CBA133
SHA1:	24830C002FFAB31102DFB674B52AFFD74E90E708
SHA-256:	EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
SHA-512:	B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8184456
Entropy (8bit):	6.15917051663501
Encrypted:	false
SSDEEP:
MD5:	5850A25689FA1B36CD6B76E2E7F6BDB3
SHA1:	299CEBD4CD448239BF5094DCC0632100287C0B85
SHA-256:	803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
SHA-512:	F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.\|.... d.t.............\|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..\|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22184
Entropy (8bit):	6.685941492131545
Encrypted:	false
SSDEEP:
MD5:	AAA9DA932D572F5B22CBEE1B4E479ED6
SHA1:	D708727DED1298610C2E3D72C8792F12FC60CFF2
SHA-256:	73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
SHA-512:	40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,..............@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc.............................@..B.................A......H........'.......................@.......................................(......0...............(....o........(....s.......0............(.......(....s....(....6r...p..(.....0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r=..p.r'..p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........

C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61608
Entropy (8bit):	6.287396747644481
Encrypted:	false
SSDEEP:
MD5:	A760AEACBE049C8C0D5DD66DD9EAA7A0
SHA1:	975896722F2D5A365621EE407ACE3E3294CFC1C3
SHA-256:	C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
SHA-512:	64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0..............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........\|.................................................(......(......(...........Z~....,..oB...&.............b~....-.r...ps....z~.....(#...o8....0..........(#......o9.....(....Q6.(.....(%....0..........(#........o:.....(....QR.(.......(....('...:(#......o?...N.(.....(.....()...2(#....o;...2(#....o<.....o......o....2(#....o=...2(#....o>...6(#.....o.......0..........s"......}"....{"...-...+....#...s.......(1...6(#.....o....*6..(....(3..

C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75432
Entropy (8bit):	6.020201057914009
Encrypted:	false
SSDEEP:
MD5:	8DC8D595216B1D7703575B77282F7147
SHA1:	5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
SHA-256:	7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
SHA-512:	F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(.....~....F~J......o.......N........s....o...+..0............(........~......o2....0............(........~K.....o.....0..%.........(..........(........~L.......o........0..H.........(..........(........~M....o.............(....(.........{........o....2~$....o....2~#....o....2~H....oz...6~I.....o~...:~J......o....2~%....o....2~&....o....>.(.......o....*...0..N........,........s.....

C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.236705505937758
Encrypted:	false
SSDEEP:
MD5:	F7543F2749BAB00FB981A41BE19734F8
SHA1:	8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
SHA-256:	634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
SHA-512:	160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	4.793020246491965
Encrypted:	false
SSDEEP:
MD5:	92C0400BF8CDD574F669E40B8D0C2BAB
SHA1:	3EB5155763A3A204982D4231C7E882DC91F0016F
SHA-256:	FDC8BFD5790E64F7DE5425BBA4C80A2E8F1648EE037D9A2B61070A8565B12A4A
SHA-512:	9698839D57A4E3A34BA24CB4BDD6CACF97695748089448AC259CD939D952DF395C82A83E260CF75F8004FE33561E1365CDA1AF1C2DC70F63E28E6EA7403CED0D
Malicious:	false
Preview:	.Uninstalling assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected parameters are:.. logtoconsole = .. logfile = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.. assemblypath = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe..Removing EventLog source FastestVPNService...Warning: The source FastestVPNService is not registered on the local machine...Service FastestVPNService is being removed from the system.....An exception occurred during the uninstallation of the System.ServiceProcess.ServiceInstaller installer...System.ComponentModel.Win32Exception: The specified service does not exist as an installed service..An exception occurred while uninstalling. This exception will be ignored and the uninstall will continue. However, the application might not be fully uninstalled after the uninstall is complete...Installing assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
Category:	dropped
Size (bytes):	7466
Entropy (8bit):	5.1606801095705865
Encrypted:	false
SSDEEP:
MD5:	FFB29BD88BD23C639985F1D369DBD1CA
SHA1:	F0AF5F803F59668AD52EA4B212A1CDE00DD5FE14
SHA-256:	1ADB4F9D1D152E018246A0A2762B473D910906340207F57D3F8CE1097E1DE09F
SHA-512:	1C12CF185691EE3D44A8522665F6AD20F41A4EE9C5A758B8DD2ABF7CC8F5F863F5CF5CB919BADFCDEE40394A89DA2C9A9601B93FB01B867932FAD4C03932B94D
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.588649497011045
Encrypted:	false
SSDEEP:
MD5:	22D4E4267DFE093E5E23C2F3D7741AA4
SHA1:	AB18989C4442EB204528E64B18000E8E02FA2C50
SHA-256:	4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
SHA-512:	7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:..............L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{...."..}....6.(.....(......0..g.........(....... ....0.. .....0. .....". .....&. .....#. .....!. ......(,...(-...(....(/...(0...(1.....0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....Z(-....(....%-.&o........0.."........r...p..(....(....(....(......&.....................0..#....... F#.....+..(....-....X...X....2....0..1.......(....o......,...-..*..+.

C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.042117116126737
Encrypted:	false
SSDEEP:
MD5:	E40244BE7715300DC4BA229C25237728
SHA1:	F9D299542C616D860D495CE59A6FD2B90907B2E5
SHA-256:	AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
SHA-512:	CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
Malicious:	true
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.743456157396208
Encrypted:	false
SSDEEP:
MD5:	FB8F7A7B8FD8826568D2DEE10D1C9AC1
SHA1:	D59BBFA7ED11D7044716AD555C4618824133A06C
SHA-256:	B3C7D69A8763580BB1B0978B8C87FED4E1C8C9934497451D3D813B46B3F8A3F3
SHA-512:	9DE3C7198F3C42227B9DE16246C189DEF584F51B2A17D210D3ED37346BD7B32989B5CB4F26F548E8FD3C88B166F6FBC1BB3A1DA1A35E83DE417ACC0F4A624485
Malicious:	false
Preview:	.....The uninstall is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The uninstall has completed.....Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Commit phase completed successfully.....The transacted install has complete

C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	347016
Entropy (8bit):	6.2576059322299855
Encrypted:	false
SSDEEP:
MD5:	F4B5415B6C9EC38B073779A034421747
SHA1:	DADEC8724A898C84A9F52A86A5D0ACFA71758341
SHA-256:	2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
SHA-512:	82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:.....{;.....{<...V.(2.....};.....}<......0..;........u......,/(3....{;....{;...o4...,.(5....{<..

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24976
Entropy (8bit):	6.836703429014385
Encrypted:	false
SSDEEP:
MD5:	5E8C253B1394C1E6E396A939C9FC9068
SHA1:	6AE721F34E256FD90A99617BA19040D45FF6A41F
SHA-256:	4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
SHA-512:	22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}.....0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..%............(....,...(.....{.....o....o........0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+v..{......o#...Q.P,..Po$......0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166800
Entropy (8bit):	5.092225196099469
Encrypted:	false
SSDEEP:
MD5:	2839920AD2E9C4B08F97715D88586056
SHA1:	88F7544BF59DDD40E3C934C938A20164F3B518F1
SHA-256:	A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
SHA-512:	E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............\|S......D^......................................j.-.r...ps$...z.s....(......0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+..-.r...ps$...z......(+.........%...o,...N.sD...%.oC...(....b.sD...%.s-...oC...(....2.sD...(........0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}......0..?.........(/...}4......}5......}6......}3.....\|4.....(...+..\|4...(1...j.{....,..{....r]..p.

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101776
Entropy (8bit):	6.519631245398067
Encrypted:	false
SSDEEP:
MD5:	58D1267BAFC9E0D9531D7C97A08A3A68
SHA1:	1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
SHA-256:	34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
SHA-512:	E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-.................0............(...+..-............(...+....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(.....0..D........{1....(4...-..{0...-.(5....{1....o6...o3....l......(........o6....0...........{.......o7...,....(....*...0..........s8..

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80784
Entropy (8bit):	6.644018601476374
Encrypted:	false
SSDEEP:
MD5:	056A3B1C036A46447EBCA7083DA271A5
SHA1:	8044FD37E124DF9BAFCE4311DB66D6B931120006
SHA-256:	6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
SHA-512:	3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..................................................................(........(........(........(......(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....j...(....%-.&.{......o)......0..........s........%-.&~.......,(...+-....(......-..(,...-....(......-....o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-.........s/......0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65960
Entropy (8bit):	6.704364809732977
Encrypted:	false
SSDEEP:
MD5:	3B6AD220174768E52510D449C7A5C817
SHA1:	E76CB664268F45939A0A604E31CAB3DBE957510A
SHA-256:	294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
SHA-512:	43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o .....(!....s"...(......(......(......{....R..}.....(.....o#.....{...."..}......{...."..}....z.(!.....(......%-.&s$...(......{...."..}......{...."..}......(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z....0..g.........,...-.r...ps....z.o)...o..../...o)...o+....

C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122256
Entropy (8bit):	6.572766216409801
Encrypted:	false
SSDEEP:
MD5:	C24CF68C9012B4E261D2FD6B2240BBE8
SHA1:	45844AE139DB45652AAC12E1D6EE138ED709E261
SHA-256:	42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
SHA-512:	DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......\|........................................-.r...ps(...z......()....o.....-.r...ps(...z.-.r...ps(...z.......%...(...+&..-.r...ps(...z.-.r...ps(...z.......%...(...+...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(.......0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\Service\Owin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15528
Entropy (8bit):	6.93175318343703
Encrypted:	false
SSDEEP:
MD5:	ADF6FCD8199E4DA7F52FBEBD9D9496D7
SHA1:	17E7E444AB035AE759D3B0E48928B7D23CEC3682
SHA-256:	C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
SHA-512:	72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28648
Entropy (8bit):	6.283743404391549
Encrypted:	false
SSDEEP:
MD5:	9FFF1DA4E481028262E27AEFD7C0EFF4
SHA1:	B0128E42E3CE3C295C48461A651AF99D95B5A04D
SHA-256:	3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
SHA-512:	6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{......0..1..........j...(.........(...._,.r...p(I...s....z..}......{...."..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3718937380199785
Encrypted:	false
SSDEEP:
MD5:	D438F337397A4CB3CA4E87F70BC4B4C0
SHA1:	FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
SHA-256:	80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
SHA-512:	8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.426868083769682
Encrypted:	false
SSDEEP:
MD5:	D4BECC422A254D1A75CFC60750572848
SHA1:	2AE1D45045828B8D9A57DD90213F462D72F9A98B
SHA-256:	A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
SHA-512:	91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377780370750934
Encrypted:	false
SSDEEP:
MD5:	14515F3569114E0060716ABD3AB3265A
SHA1:	9E2DBC71979FFB5E3270C9353EA53448D9E07544
SHA-256:	94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
SHA-512:	7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.401085070695131
Encrypted:	false
SSDEEP:
MD5:	AD53B27150F1E38EF23BD155A07E2313
SHA1:	3A9A4383B9286A0E1A3F4102BC56437A5A961E41
SHA-256:	62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
SHA-512:	F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.721932799011409
Encrypted:	false
SSDEEP:
MD5:	8E6A799F0DA3FBA278F06D4C7A18E7B5
SHA1:	B9AD516A47362FFAF360C1E8794D2F10C8E7080F
SHA-256:	1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
SHA-512:	4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\Service\VPN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.788270069437216
Encrypted:	false
SSDEEP:
MD5:	A891AAC2D9FD1B939E07BE155AFC84FF
SHA1:	7F977350D9CFD10C259356D98C0606779519C6EF
SHA-256:	38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
SHA-512:	E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.829205499580206
Encrypted:	false
SSDEEP:
MD5:	76DC589253A2FDAAA3CDD02E9F5421DD
SHA1:	A072B9CDDBDC150394643EBFD565A2443AFD9501
SHA-256:	9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
SHA-512:	50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-0P3G0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.822993671222324
Encrypted:	false
SSDEEP:
MD5:	8E545EE7F96C317AADC4EDA0F0FCF481
SHA1:	242F4D714B142C10368AA82AF91B0A06E0A4E33F
SHA-256:	A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
SHA-512:	77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-25GUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101776
Entropy (8bit):	6.519631245398067
Encrypted:	false
SSDEEP:
MD5:	58D1267BAFC9E0D9531D7C97A08A3A68
SHA1:	1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
SHA-256:	34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
SHA-512:	E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-.................0............(...+..-............(...+....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(.....0..D........{1....(4...-..{0...-.(5....{1....o6...o3....l......(........o6....0...........{.......o7...,....(....*...0..........s8..

C:\Program Files\FastestVPN\Service\is-25JMN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3718937380199785
Encrypted:	false
SSDEEP:
MD5:	D438F337397A4CB3CA4E87F70BC4B4C0
SHA1:	FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
SHA-256:	80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
SHA-512:	8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\Service\is-9V0LH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377780370750934
Encrypted:	false
SSDEEP:
MD5:	14515F3569114E0060716ABD3AB3265A
SHA1:	9E2DBC71979FFB5E3270C9353EA53448D9E07544
SHA-256:	94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
SHA-512:	7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\Service\is-B2JMI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65960
Entropy (8bit):	6.704364809732977
Encrypted:	false
SSDEEP:
MD5:	3B6AD220174768E52510D449C7A5C817
SHA1:	E76CB664268F45939A0A604E31CAB3DBE957510A
SHA-256:	294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
SHA-512:	43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o .....(!....s"...(......(......(......{....R..}.....(.....o#.....{...."..}......{...."..}....z.(!.....(......%-.&s$...(......{...."..}......{...."..}......(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z....0..g.........,...-.r...ps....z.o)...o..../...o)...o+....

C:\Program Files\FastestVPN\Service\is-BEQUD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.401085070695131
Encrypted:	false
SSDEEP:
MD5:	AD53B27150F1E38EF23BD155A07E2313
SHA1:	3A9A4383B9286A0E1A3F4102BC56437A5A961E41
SHA-256:	62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
SHA-512:	F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\Service\is-BU4VV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15528
Entropy (8bit):	6.93175318343703
Encrypted:	false
SSDEEP:
MD5:	ADF6FCD8199E4DA7F52FBEBD9D9496D7
SHA1:	17E7E444AB035AE759D3B0E48928B7D23CEC3682
SHA-256:	C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
SHA-512:	72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

C:\Program Files\FastestVPN\Service\is-C4FPO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166800
Entropy (8bit):	5.092225196099469
Encrypted:	false
SSDEEP:
MD5:	2839920AD2E9C4B08F97715D88586056
SHA1:	88F7544BF59DDD40E3C934C938A20164F3B518F1
SHA-256:	A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
SHA-512:	E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............\|S......D^......................................j.-.r...ps$...z.s....(......0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+..-.r...ps$...z......(+.........%...o,...N.sD...%.oC...(....b.sD...%.s-...oC...(....2.sD...(........0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}......0..?.........(/...}4......}5......}6......}3.....\|4.....(...+..\|4...(1...j.{....,..{....r]..p.

C:\Program Files\FastestVPN\Service\is-CVIBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80784
Entropy (8bit):	6.644018601476374
Encrypted:	false
SSDEEP:
MD5:	056A3B1C036A46447EBCA7083DA271A5
SHA1:	8044FD37E124DF9BAFCE4311DB66D6B931120006
SHA-256:	6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
SHA-512:	3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..................................................................(........(........(........(......(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....j...(....%-.&.{......o)......0..........s........%-.&~.......,(...+-....(......-..(,...-....(......-....o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-.........s/......0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

C:\Program Files\FastestVPN\Service\is-G5QC8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122256
Entropy (8bit):	6.572766216409801
Encrypted:	false
SSDEEP:
MD5:	C24CF68C9012B4E261D2FD6B2240BBE8
SHA1:	45844AE139DB45652AAC12E1D6EE138ED709E261
SHA-256:	42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
SHA-512:	DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......\|........................................-.r...ps(...z......()....o.....-.r...ps(...z.-.r...ps(...z.......%...(...+&..-.r...ps(...z.-.r...ps(...z.......%...(...+...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(.......0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

C:\Program Files\FastestVPN\Service\is-GNOTT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.721932799011409
Encrypted:	false
SSDEEP:
MD5:	8E6A799F0DA3FBA278F06D4C7A18E7B5
SHA1:	B9AD516A47362FFAF360C1E8794D2F10C8E7080F
SHA-256:	1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
SHA-512:	4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\Service\is-GV36A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24976
Entropy (8bit):	6.836703429014385
Encrypted:	false
SSDEEP:
MD5:	5E8C253B1394C1E6E396A939C9FC9068
SHA1:	6AE721F34E256FD90A99617BA19040D45FF6A41F
SHA-256:	4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
SHA-512:	22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}.....0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..%............(....,...(.....{.....o....o........0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+v..{......o#...Q.P,..Po$......0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

C:\Program Files\FastestVPN\Service\is-HMSV9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	347016
Entropy (8bit):	6.2576059322299855
Encrypted:	false
SSDEEP:
MD5:	F4B5415B6C9EC38B073779A034421747
SHA1:	DADEC8724A898C84A9F52A86A5D0ACFA71758341
SHA-256:	2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
SHA-512:	82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0.....{1...V.(2.....}0.....}1......0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6..... .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:.....{;.....{<...V.(2.....};.....}<......0..;........u......,/(3....{;....{;...o4...,.(5....{<..

C:\Program Files\FastestVPN\Service\is-KA6B7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\Service\is-N257N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.042117116126737
Encrypted:	false
SSDEEP:
MD5:	E40244BE7715300DC4BA229C25237728
SHA1:	F9D299542C616D860D495CE59A6FD2B90907B2E5
SHA-256:	AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
SHA-512:	CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

C:\Program Files\FastestVPN\Service\is-NRIKT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.236705505937758
Encrypted:	false
SSDEEP:
MD5:	F7543F2749BAB00FB981A41BE19734F8
SHA1:	8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
SHA-256:	634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
SHA-512:	160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\Service\is-OP4DR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.829205499580206
Encrypted:	false
SSDEEP:
MD5:	76DC589253A2FDAAA3CDD02E9F5421DD
SHA1:	A072B9CDDBDC150394643EBFD565A2443AFD9501
SHA-256:	9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
SHA-512:	50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-RSP45.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.588649497011045
Encrypted:	false
SSDEEP:
MD5:	22D4E4267DFE093E5E23C2F3D7741AA4
SHA1:	AB18989C4442EB204528E64B18000E8E02FA2C50
SHA-256:	4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
SHA-512:	7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:..............L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{...."..}....6.(.....(......0..g.........(....... ....0.. .....0. .....". .....&. .....#. .....!. ......(,...(-...(....(/...(0...(1.....0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....Z(-....(....%-.&o........0.."........r...p..(....(....(....(......&.....................0..#....... F#.....+..(....-....X...X....2....0..1.......(....o......,...-..*..+.

C:\Program Files\FastestVPN\Service\is-SA7LQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.788270069437216
Encrypted:	false
SSDEEP:
MD5:	A891AAC2D9FD1B939E07BE155AFC84FF
SHA1:	7F977350D9CFD10C259356D98C0606779519C6EF
SHA-256:	38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
SHA-512:	E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\Service\is-SGO0H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.426868083769682
Encrypted:	false
SSDEEP:
MD5:	D4BECC422A254D1A75CFC60750572848
SHA1:	2AE1D45045828B8D9A57DD90213F462D72F9A98B
SHA-256:	A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
SHA-512:	91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\Service\is-T1I9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28648
Entropy (8bit):	6.283743404391549
Encrypted:	false
SSDEEP:
MD5:	9FFF1DA4E481028262E27AEFD7C0EFF4
SHA1:	B0128E42E3CE3C295C48461A651AF99D95B5A04D
SHA-256:	3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
SHA-512:	6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{......0..1..........j...(.........(...._,.r...p(I...s....z..}......{...."..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

C:\Program Files\FastestVPN\Service\is-TF74Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\is-TKLHN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\nfapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\Service\subinacl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.822993671222324
Encrypted:	false
SSDEEP:
MD5:	8E545EE7F96C317AADC4EDA0F0FCF481
SHA1:	242F4D714B142C10368AA82AF91B0A06E0A4E33F
SHA-256:	A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
SHA-512:	77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160936
Entropy (8bit):	5.261187861382329
Encrypted:	false
SSDEEP:
MD5:	F3F2EB62314A960AD5F60B61A8193CBD
SHA1:	FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
SHA-256:	0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
SHA-512:	A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J..............8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@.....................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.\|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...\|..qXV..6.......i[..2;.'`..=.;...~......0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T..~....,.~....o..........~....,.~....(...........0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&....0..A.......

C:\Program Files\FastestVPN\System.Buffers.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22696
Entropy (8bit):	6.669675167195394
Encrypted:	false
SSDEEP:
MD5:	657A48C8DA3DE14059498E383EBEF318
SHA1:	ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
SHA-256:	201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
SHA-512:	C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`..............................A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......(....R. ...(...+%-.&("...^. ...(#....(...+&~ ....s%..."..s&.....('....*....0........................((

C:\Program Files\FastestVPN\System.Memory.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143528
Entropy (8bit):	6.164743567434074
Encrypted:	false
SSDEEP:
MD5:	24DF113016A58EB1D14691CFE947C2C8
SHA1:	E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
SHA-256:	4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
SHA-512:	10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8...................@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...>..}......}......{......{......{.....{....3..{.....{....()......0...........%.u....,..........(.....z.{....%-.&.+.o....{....(a.....(....zN........o+...s,....(....z.s-.....(....zF(U....(O...s.....(....z.(V...s.....(....z.s/....(....z.s0.....(....zN........o+...s1....(....zrr...p(\....c.M...(O...s2....(....zBr...p(Y...s2....(....z.s3....(....z.(X...s4....(!...z.(_...s4...*.(#...z

C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110760
Entropy (8bit):	5.479763068610726
Encrypted:	false
SSDEEP:
MD5:	3FC875FFEFAC2BBA64E6F2A6A7CFF45B
SHA1:	CAB48D6D156261CD9612633D70A61DA670D0D093
SHA-256:	5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
SHA-512:	DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O..................................t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....&.l(....k&.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rG..p.(....2r...p.(....2r...p.(..........(.......

C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.361391591273708
Encrypted:	false
SSDEEP:
MD5:	DA04A75DDC22118ED24E0B53E474805A
SHA1:	2D68C648A6A6371B6046E6C3AF09128230E0AD32
SHA-256:	66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
SHA-512:	26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$\|.j.6W.U.3.r.A.h.....9Q..\|..,<g..gy..6V9o%..Gd.r.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files\FastestVPN\Updater.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354984
Entropy (8bit):	6.846739611307464
Encrypted:	false
SSDEEP:
MD5:	D822226C4B35A7305269C8E16E542D3E
SHA1:	12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
SHA-256:	FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
SHA-512:	3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@.............................................................. ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~.............,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&....0..5........r...p.s....(.....{....,...}....r!..p.s.......(...."..}......(.....rY..p.......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

C:\Program Files\FastestVPN\Updater.exe.config (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.038231865445437
Encrypted:	false
SSDEEP:
MD5:	75E66AB540561A0C7D4160271F518243
SHA1:	AD6501E407D216744B6C3DE76D7664D9581EBAD2
SHA-256:	091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
SHA-512:	FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3704146545353355
Encrypted:	false
SSDEEP:
MD5:	26592109F19A24EE91F039EBB40038C4
SHA1:	C8846404EFEB44C6CBB242B4C107F7CCE865AD14
SHA-256:	E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
SHA-512:	8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\VPN.Common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.4260026936119194
Encrypted:	false
SSDEEP:
MD5:	550D6E67BB1795B941E91840508BF7F6
SHA1:	46E22693BDC92F4E8DD8C4C5433D233438A271EF
SHA-256:	D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
SHA-512:	1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377831305172757
Encrypted:	false
SSDEEP:
MD5:	CE66CBCDA6D3B5047691C4AFF63CFE79
SHA1:	358E3A2284798BE1C537756A41721B61643D2BEE
SHA-256:	B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
SHA-512:	7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\VPN.RAS.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.4006875255426365
Encrypted:	false
SSDEEP:
MD5:	FDF4712500755002CD0FFD2F7BEA8C2A
SHA1:	372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
SHA-256:	D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
SHA-512:	6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.723147332362829
Encrypted:	false
SSDEEP:
MD5:	14A266CFF3BC7795C208096E24D4791D
SHA1:	D55A976C562A309B4EEB860E711324A22357470E
SHA-256:	2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
SHA-512:	E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\VPN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.784018634948529
Encrypted:	false
SSDEEP:
MD5:	CD6CB12E677F6C45BBFE57DED6C90567
SHA1:	C13525F597974BA46B4B2A71F270B1056332F77B
SHA-256:	FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
SHA-512:	6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.326182355914875
Encrypted:	false
SSDEEP:
MD5:	C4BC370961A9E628E64B8FF4586D4DA6
SHA1:	B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
SHA-256:	097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
SHA-512:	169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$..........................h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!......0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

C:\Program Files\FastestVPN\app-icon.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.1108966039740653
Encrypted:	false
SSDEEP:
MD5:	BC1059DA39659B80A09C994AE6DB5DB7
SHA1:	D7E9D74133C98F897B94C42F09B93F10E3274EDB
SHA-256:	9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
SHA-512:	F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
Malicious:	false
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.........................M&..........0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.8288213942048985
Encrypted:	false
SSDEEP:
MD5:	37E6E1D07988932C4360D74A34B27AE9
SHA1:	F53AE2462ECC565EFCC28D1C5BB2C285BF899798
SHA-256:	7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
SHA-512:	EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\iphelperclose.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-0A8FD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.823114295644
Encrypted:	false
SSDEEP:
MD5:	4798226EE22C513302EE57D3AA94398B
SHA1:	F42C6CFA4068263D955608DE47E60D099AD8B394
SHA-256:	38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
SHA-512:	94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-0BOGR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354984
Entropy (8bit):	6.846739611307464
Encrypted:	false
SSDEEP:
MD5:	D822226C4B35A7305269C8E16E542D3E
SHA1:	12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
SHA-256:	FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
SHA-512:	3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@.............................................................. ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~.............,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&....0..5........r...p.s....(.....{....,...}....r!..p.s.......(...."..}......(.....rY..p.......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

C:\Program Files\FastestVPN\is-1DJ4G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.326182355914875
Encrypted:	false
SSDEEP:
MD5:	C4BC370961A9E628E64B8FF4586D4DA6
SHA1:	B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
SHA-256:	097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
SHA-512:	169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$..........................h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!......0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

C:\Program Files\FastestVPN\is-20RRP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.1108966039740653
Encrypted:	false
SSDEEP:
MD5:	BC1059DA39659B80A09C994AE6DB5DB7
SHA1:	D7E9D74133C98F897B94C42F09B93F10E3274EDB
SHA-256:	9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
SHA-512:	F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
Malicious:	false
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.........................M&..........0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

C:\Program Files\FastestVPN\is-29PQI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	6.23750269831583
Encrypted:	false
SSDEEP:
MD5:	0F7D6DEE75C3FBB958529AB6A351CBDF
SHA1:	1CA639AB692ECD972C51C8BF826BF9BF089359FE
SHA-256:	C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
SHA-512:	58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ......................@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...^.("......I...%...}....:.(".....}....b.{....%-.&..s#...o$....0..)........{.........(%...t......\|......(...+...3.....0..)........{.........('...t......\|......(...+...3...((.....{...."..}......{...."..}......{...."..}....2.(....s).....{...."..}......{...."..}......{...."..}......((.....{...."..}......{...."..}......{...."..}......{...."..}......((.....{...."..}......{

C:\Program Files\FastestVPN\is-3M67B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75432
Entropy (8bit):	6.020201057914009
Encrypted:	false
SSDEEP:
MD5:	8DC8D595216B1D7703575B77282F7147
SHA1:	5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
SHA-256:	7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
SHA-512:	F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(.....~....F~J......o.......N........s....o...+..0............(........~......o2....0............(........~K.....o.....0..%.........(..........(........~L.......o........0..H.........(..........(........~M....o.............(....(.........{........o....2~$....o....2~#....o....2~H....oz...6~I.....o~...:~J......o....2~%....o....2~&....o....>.(.......o....*...0..N........,........s.....

C:\Program Files\FastestVPN\is-3QH42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30888
Entropy (8bit):	6.550270680442998
Encrypted:	false
SSDEEP:
MD5:	96D7E9527C5D8BDBA798F72B5FD9B94A
SHA1:	C9CE9813C74493084D6E3DDA37C35C8822CA381F
SHA-256:	6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
SHA-512:	BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N..............d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(......{...."..}......{...."..}....V.(......(......(.....0..7.........(....}.......}.......}......\|......(...+..\|....(......{...."..}......{...."..}......{...."..}......{...."..}......(......(......(......(.......(.....0..?.........(....}3......}4......}5......}2.....\|3.....(...+..\|3...(......0..7.........(....}#......}$......}".....\|#.....(...+..\|#...(....*..0..?.........(....}.......}

C:\Program Files\FastestVPN\is-69FAA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110760
Entropy (8bit):	5.479763068610726
Encrypted:	false
SSDEEP:
MD5:	3FC875FFEFAC2BBA64E6F2A6A7CFF45B
SHA1:	CAB48D6D156261CD9612633D70A61DA670D0D093
SHA-256:	5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
SHA-512:	DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O..................................t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....&.l(....k&.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rG..p.(....2r...p.(....2r...p.(..........(.......

C:\Program Files\FastestVPN\is-6HFVM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25976
Entropy (8bit):	6.331152456306087
Encrypted:	false
SSDEEP:
MD5:	3C5DFBB4E3F1AD153EB2E203B56EA0AE
SHA1:	59623BF1D67D87264C165E421F12426DA998AF46
SHA-256:	9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
SHA-512:	94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(.....0..H.........~....,...~....~..........(......~....%-.&s....%...........,..(..............#<.......0..%.......~..........(...............,..(.........................0..........~..........(....(....o....(...+....,..(.................".......0..0.......~..........(....(.....o.....(...+....,..(...............$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

C:\Program Files\FastestVPN\is-6OAGB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Program Files\FastestVPN\is-6P2C9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.623350319992477
Encrypted:	false
SSDEEP:
MD5:	D92BF2C8E0A192E18B1F0B24CCB75171
SHA1:	2A6343C3409172E1D426B763151E0CBA3B35E473
SHA-256:	BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
SHA-512:	71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:.............,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....^~....-.s.........~......{...."..}......{...."..}......0..8........(........(.....(.....o....r...p(....o.......&..r...p.........--.......0..(.......(.....o........(.....(.......&..r...p..................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2...0..V...

C:\Program Files\FastestVPN\is-7D6TA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.8288213942048985
Encrypted:	false
SSDEEP:
MD5:	37E6E1D07988932C4360D74A34B27AE9
SHA1:	F53AE2462ECC565EFCC28D1C5BB2C285BF899798
SHA-256:	7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
SHA-512:	EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H\|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-7KO33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-7ULB1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22696
Entropy (8bit):	6.669675167195394
Encrypted:	false
SSDEEP:
MD5:	657A48C8DA3DE14059498E383EBEF318
SHA1:	ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
SHA-256:	201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
SHA-512:	C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`..............................A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......(....R. ...(...+%-.&("...^. ...(#....(...+&~ ....s%..."..s&.....('....*....0........................((

C:\Program Files\FastestVPN\is-8KR34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Program Files\FastestVPN\is-8SCCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3316968
Entropy (8bit):	6.532906510598102
Encrypted:	false
SSDEEP:
MD5:	0CF454B6ED4D9E46BC40306421E4B800
SHA1:	9611AA929D35CBD86B87E40B628F60D5177D2411
SHA-256:	E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
SHA-512:	85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............\|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s..........~....-(....o....o....o.........~....-.~.........~......( ......0..G.......(!....o"....s.1....s,..%..(.... ....o.....o 0...Zo....t....o8(..(......0..$..........(.....(....o.....(!.......io#...z...(....(!....o"...o....(......0............T....r...p.(O....o$....(......0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox.....( ...*V.(&.....}......}..

C:\Program Files\FastestVPN\is-AJ7UA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	6.3704146545353355
Encrypted:	false
SSDEEP:
MD5:	26592109F19A24EE91F039EBB40038C4
SHA1:	C8846404EFEB44C6CBB242B4C107F7CCE865AD14
SHA-256:	E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
SHA-512:	8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`..............v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}........(....(....(....

C:\Program Files\FastestVPN\is-BT6B4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29352
Entropy (8bit):	6.56368110636982
Encrypted:	false
SSDEEP:
MD5:	1CFBF0CBA3C87653D9639ADA438C3291
SHA1:	07E36A34319EAD85857CC022E277B69EA132750B
SHA-256:	3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
SHA-512:	E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H.............\|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....:.(......}......0..)........u..........,.(.....{.....{....o......v .5Q' )UU.Z(.....{....o....X..0..:........r...p......%..{.......%q.........-.&.+.......o.....(......{....:.(......}........0..)........u..........,.(.....{.....{....o......v . .q )UU.Z(.....{....o....X..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(......{......{....V.(......}......}.....0..A.......

C:\Program Files\FastestVPN\is-CPTP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\is-D2992.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20136
Entropy (8bit):	6.723147332362829
Encrypted:	false
SSDEEP:
MD5:	14A266CFF3BC7795C208096E24D4791D
SHA1:	D55A976C562A309B4EEB860E711324A22357470E
SHA-256:	2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
SHA-512:	E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$......`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(......{...."..}......0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ......r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&..r?..prK..p.(.........(#...("...&*..r?..pr...

C:\Program Files\FastestVPN\is-EAFR9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149896
Entropy (8bit):	6.136390335470081
Encrypted:	false
SSDEEP:
MD5:	70B1C15FDBBFB88F91965DC7BBC5527F
SHA1:	A473571DAC42819933CD7EF0C604F1EA0614D2F3
SHA-256:	109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
SHA-512:	C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+.~.....~.....~......%-.&(......%-.&~ .......0..........(!......o"......(7..........................0..........(!......o...+...(...+........................~$...%-.&~%.....&...s'...%.$....(...+.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+..0..9.......s......}+.....},.....}-................s/... ....(B...&....0..$........,...r...p......%.....o~......o0...*

C:\Program Files\FastestVPN\is-EEEM3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\is-F31HU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3070013
Entropy (8bit):	6.39701754184779
Encrypted:	false
SSDEEP:
MD5:	A2386053A831B1C65F9BB923F4F17A7B
SHA1:	530BC9411C100138963776A527966EA98D2D1FD9
SHA-256:	3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
SHA-512:	2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf.......................................@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\Program Files\FastestVPN\is-FMQAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48256
Entropy (8bit):	6.234996524588368
Encrypted:	false
SSDEEP:
MD5:	37EB7CCE6E282D3572D64C880E1AC3C8
SHA1:	9A2952589A19D650932E7C633577EB9AFC04F959
SHA-256:	039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
SHA-512:	E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(......(....^.(.......>...%...}....:.(......}....:.(......}....:.(......}....:.(......}....*.-..(......s....z.~.......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......( ....(....,.r...p......%...%...%...(.......(!....(....,!r...p......%...%...%...%...(........(".....,&(....,..r...pr...p.(....(#.....($.....(.

C:\Program Files\FastestVPN\is-FP6VU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19112
Entropy (8bit):	6.821071301483957
Encrypted:	false
SSDEEP:
MD5:	64E2269D156CA2AA5704E2E0908506F9
SHA1:	0F7D6EECE52D8A9A91E389736BE1092739AA3014
SHA-256:	B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
SHA-512:	C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ......`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~.............s......s......0..B.......(....,.s....(....(....(....(....(....(.....(....(....(.....(......(...+F.(...+(...+(...+F.(...+(...+(...+F.(...+(...+(...+.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+..(...+...0...........-......8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

C:\Program Files\FastestVPN\is-G38N1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49320
Entropy (8bit):	6.325351798150663
Encrypted:	false
SSDEEP:
MD5:	C22900453EF4B917460ADEA7DE87225B
SHA1:	6878237656DA68C046FB95FAA8CAF3B4C719851B
SHA-256:	9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
SHA-512:	2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,..............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{".....{#...V.($.....}".....}#......0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...... ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o...X...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,.....{-.....{....V.($.....}-.....}.....0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...... (... )UU.

C:\Program Files\FastestVPN\is-G6DJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60584
Entropy (8bit):	6.4260026936119194
Encrypted:	false
SSDEEP:
MD5:	550D6E67BB1795B941E91840508BF7F6
SHA1:	46E22693BDC92F4E8DD8C4C5433D233438A271EF
SHA-256:	D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
SHA-512:	1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O......................................8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....>.(....o4......>.(....o4......>.(....o2......>.(....o2......>.(....o2......v.(....-..(....,..(....+..+....{...."..}....6..s....}......0............(......,...(k.........0..4.......s......(....}......}......}......}.....\|......(...+.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

C:\Program Files\FastestVPN\is-GP1QP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26752
Entropy (8bit):	6.512503595653532
Encrypted:	false
SSDEEP:
MD5:	970B6E6478AE3AB699F277D77DE0CD19
SHA1:	5475CB28998D419B4714343FFA9511FF46322AC2
SHA-256:	5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
SHA-512:	F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P..................,R........................................(......(....^.(.......1...%...}....:.(......}....:.(......}....:.(......}....:.(......}......(......(......(......(....:.(......}......{....:.(......}......{....:.(......}......{......(....:.(......}......{....^.(.......2...%...}....:.(......}......{....z.(......}.......2...%...}....V.(......}......}......{......{....:.(......}......{......{...."..}......{...."..}......{

C:\Program Files\FastestVPN\is-H0O73.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	6.761472837087098
Encrypted:	false
SSDEEP:
MD5:	12A69C58D97C26D0132D493111E42345
SHA1:	0DCC8570C7D76B660746A0F657607864F8764AD4
SHA-256:	E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
SHA-512:	3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."......`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0../.........(....}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(....6..(...+(......(......(......{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

C:\Program Files\FastestVPN\is-HG5LC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143528
Entropy (8bit):	6.164743567434074
Encrypted:	false
SSDEEP:
MD5:	24DF113016A58EB1D14691CFE947C2C8
SHA1:	E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
SHA-256:	4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
SHA-512:	10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8...................@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...>..}......}......{......{......{.....{....3..{.....{....()......0...........%.u....,..........(.....z.{....%-.&.+.o....{....(a.....(....zN........o+...s,....(....z.s-.....(....zF(U....(O...s.....(....z.(V...s.....(....z.s/....(....z.s0.....(....zN........o+...s1....(....zrr...p(\....c.M...(O...s2....(....zBr...p(Y...s2....(....z.s3....(....z.(X...s4....(!...z.(_...s4...*.(#...z

C:\Program Files\FastestVPN\is-HGUF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160936
Entropy (8bit):	5.261187861382329
Encrypted:	false
SSDEEP:
MD5:	F3F2EB62314A960AD5F60B61A8193CBD
SHA1:	FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
SHA-256:	0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
SHA-512:	A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J..............8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@.....................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.\|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...\|..qXV..6.......i[..2;.'`..=.;...~......0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T..~....,.~....o..........~....,.~....(...........0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&....0..A.......

C:\Program Files\FastestVPN\is-HT2O2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	53624
Entropy (8bit):	6.18841715621451
Encrypted:	false
SSDEEP:
MD5:	B7ABAF6A90E95E585E71C0C22D90AF73
SHA1:	C9756883D1738A9931D0BF58D6F69CBB8DFD5870
SHA-256:	3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
SHA-512:	3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....2.r...p(....V.(......}......}......{......{......{......(......}......}......}.......}.......}......{......{......{......{......{.......0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...+...3...0..'.......~.........(....t............(...

C:\Program Files\FastestVPN\is-ILS2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.038231865445437
Encrypted:	false
SSDEEP:
MD5:	75E66AB540561A0C7D4160271F518243
SHA1:	AD6501E407D216744B6C3DE76D7664D9581EBAD2
SHA-256:	091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
SHA-512:	FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

C:\Program Files\FastestVPN\is-IN04I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.0141792226861375
Encrypted:	false
SSDEEP:
MD5:	8F6EB9E75E6A6F0C0D58FB697C10CEDF
SHA1:	6944935DFDC33E0C6DB26869BF25EDA85A2622D8
SHA-256:	E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
SHA-512:	A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

C:\Program Files\FastestVPN\is-IQIIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22184
Entropy (8bit):	6.685941492131545
Encrypted:	false
SSDEEP:
MD5:	AAA9DA932D572F5B22CBEE1B4E479ED6
SHA1:	D708727DED1298610C2E3D72C8792F12FC60CFF2
SHA-256:	73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
SHA-512:	40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,..............@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc.............................@..B.................A......H........'.......................@.......................................(......0...............(....o........(....s.......0............(.......(....s....(....6r...p..(.....0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z..0..#.......(......-...(......3...(....s....z...(....%~....(....,.r=..p.r'..p(....s....z..0..#.......(......-..(....&..3..(....&s....z..0..7..........~....%-.&~..........s....%.....(.........

C:\Program Files\FastestVPN\is-JS6M2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124072
Entropy (8bit):	6.169344446608534
Encrypted:	false
SSDEEP:
MD5:	2DC3102392DAEF9B935CDF4939A9B132
SHA1:	F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
SHA-256:	B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
SHA-512:	596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}......}......{......{......{......{......{....J.......s!...s:....~....%-.&~..........s!...%.....s:...J.......s"...s#...J.......s!...s:.....0..........(...+o$.....E........9...^...*.r...pr...pr..

C:\Program Files\FastestVPN\is-KPVP8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.361391591273708
Encrypted:	false
SSDEEP:
MD5:	DA04A75DDC22118ED24E0B53E474805A
SHA1:	2D68C648A6A6371B6046E6C3AF09128230E0AD32
SHA-256:	66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
SHA-512:	26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$\|.j.6W.U.3.r.A.h.....9Q..\|..,<g..gy..6V9o%..Gd.r.0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..................0..................0..................0..........

C:\Program Files\FastestVPN\is-LEV7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.059106104983516
Encrypted:	false
SSDEEP:
MD5:	66373624F8B60F41B8FEC0E61779C0AC
SHA1:	0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
SHA-256:	FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
SHA-512:	74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

C:\Program Files\FastestVPN\is-O6V0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2059432
Entropy (8bit):	7.651137710710665
Encrypted:	false
SSDEEP:
MD5:	01CF6EF766C41BB2C99A2CCCDECC69C1
SHA1:	8DD5EB983C1C8F2E3A2538E50295644BB778A69E
SHA-256:	9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
SHA-512:	9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B.................8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(.......(......{...."..}......{...."..}......{...."..}......{...."..}.......(.......(....(.......(....(.......(....(......0..5........('...-...((.....o)...(...(+...(,.......,..o-.................)........(....2.(/...o0.....(1....(2...2.(....o3.....(....o4...&.(.....o5....(.....o5....(....o6...&2.(....o7

C:\Program Files\FastestVPN\is-O947P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61608
Entropy (8bit):	6.287396747644481
Encrypted:	false
SSDEEP:
MD5:	A760AEACBE049C8C0D5DD66DD9EAA7A0
SHA1:	975896722F2D5A365621EE407ACE3E3294CFC1C3
SHA-256:	C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
SHA-512:	64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0..............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........\|.................................................(......(......(...........Z~....,..oB...&.............b~....-.r...ps....z~.....(#...o8....0..........(#......o9.....(....Q6.(.....(%....0..........(#........o:.....(....QR.(.......(....('...:(#......o?...N.(.....(.....()...2(#....o;...2(#....o<.....o......o....2(#....o=...2(#....o>...6(#.....o.......0..........s"......}"....{"...-...+....#...s.......(1...6(#.....o....*6..(....(3..

C:\Program Files\FastestVPN\is-OV817.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	147848
Entropy (8bit):	6.032707503792338
Encrypted:	false
SSDEEP:
MD5:	B6DB385295FA78A6AABCF217FD3C3F83
SHA1:	71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
SHA-256:	ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
SHA-512:	122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X.....rS..po%...,.r[..prg..p(X....~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((............U.E........(....*.

C:\Program Files\FastestVPN\is-QAEOR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116872
Entropy (8bit):	6.726218253535254
Encrypted:	false
SSDEEP:
MD5:	B9F4D43230B7FB66B95AF05DC03B32DE
SHA1:	56F868C56FFF836CA61055499988F965DCA37D26
SHA-256:	A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
SHA-512:	50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\is-RAUHQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117928
Entropy (8bit):	6.160360774488817
Encrypted:	false
SSDEEP:
MD5:	FDFDFE021B53B630939D27C6C90CB435
SHA1:	AA0987A6EA6987BB9930B9167EC31C249EF9D885
SHA-256:	D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
SHA-512:	1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O......................................T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...>..su...%.}^......0...........(+...,.....(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

C:\Program Files\FastestVPN\is-RR5LV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18088
Entropy (8bit):	6.784018634948529
Encrypted:	false
SSDEEP:
MD5:	CD6CB12E677F6C45BBFE57DED6C90567
SHA1:	C13525F597974BA46B4B2A71F270B1056332F77B
SHA-256:	FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
SHA-512:	6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H...................`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{...."..}......{...."..}......{...."..}......(........%-.&r...ps....z(.......(......0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o..................tu.......0..B..........(....%-.&+.o.......&..(.....(....%-.&.+.(......s....o..........................0..B..........(....%-.&+.o ......*&..(.....

C:\Program Files\FastestVPN\is-SBGRB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31912
Entropy (8bit):	6.377831305172757
Encrypted:	false
SSDEEP:
MD5:	CE66CBCDA6D3B5047691C4AFF63CFE79
SHA1:	358E3A2284798BE1C537756A41721B61643D2BEE
SHA-256:	B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
SHA-512:	7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................h..O....................R..............g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{...."..}......{...."..}......{...."..}......{...."..}....&..(........0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+..............et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

C:\Program Files\FastestVPN\is-SELKR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88192
Entropy (8bit):	6.25584016939133
Encrypted:	false
SSDEEP:
MD5:	4186A905DC180A0CC2110403727BD792
SHA1:	E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
SHA-256:	40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
SHA-512:	1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(......(....^.(.......k...%...}....:.(......}....:.(......}....:.(......}....:.(......}.....~......0..........(....,....(.....o ......&......................0...........(.......(!...-..,....(....,.r...p......%...%...(".....(#....(....,.r...p......%...%...%...("......($....(....,!r...p......%...%...%...%...(".......(%.....,&(....,..r...pr...p.("...(&.....('....*.(....,.r...p......%...

C:\Program Files\FastestVPN\is-TIJQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108200
Entropy (8bit):	7.332504567097915
Encrypted:	false
SSDEEP:
MD5:	261A5044C94F318DEEA20D178ED9F36E
SHA1:	2A9704F70A543EE219481A3AA756A0CF151E1999
SHA-256:	D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
SHA-512:	E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................\|.................p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..\|w..................,.......................................V!.)1......s............0..$........u......,...o.....u......,...o.....0..&........u......,....o ....u......,....o!......0..&........u......,....o"....u......,....o#...B.(Y...-.(.......{!..."..}!...>.{....o........0..9........(.....($.....(......,..o%...-..,..o&...-..,..o%.....*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

C:\Program Files\FastestVPN\is-TJLQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.030466366630491
Encrypted:	false
SSDEEP:
MD5:	B94AE93769D64791440B3C36CC82AC69
SHA1:	E4AAAD9A0FB51051C8B25F768BC1563543F132C0
SHA-256:	432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
SHA-512:	AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

C:\Program Files\FastestVPN\is-U9EKE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41128
Entropy (8bit):	6.4006875255426365
Encrypted:	false
SSDEEP:
MD5:	FDF4712500755002CD0FFD2F7BEA8C2A
SHA1:	372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
SHA-256:	D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
SHA-512:	6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v.............@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{...."..}......{...."..}......~....}......s....}.....(........(.............s...}........0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+....0..F.......

C:\Program Files\FastestVPN\nfapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159368
Entropy (8bit):	6.32384599449582
Encrypted:	false
SSDEEP:
MD5:	7AE17C855F3CC63174E90EA527B6138B
SHA1:	0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
SHA-256:	26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
SHA-512:	453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\subinacl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301224
Entropy (8bit):	5.823114295644
Encrypted:	false
SSDEEP:
MD5:	4798226EE22C513302EE57D3AA94398B
SHA1:	F42C6CFA4068263D955608DE47E60D099AD8B394
SHA-256:	38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
SHA-512:	94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.\|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\FastestVPN\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	InnoSetup Log 64-bit FastestVPN, version 0x418, 26323 bytes, 284992\37\user\37, C:\Program Files\FastestVPN\376\377\377\00
Category:	dropped
Size (bytes):	26323
Entropy (8bit):	3.4479823117815274
Encrypted:	false
SSDEEP:
MD5:	F5D415DE889E24181844D889575F952A
SHA1:	B8C8AEF60020D9512BDF0E2B2053236B9B159C9B
SHA-256:	AC7F4E6EBAB5936769460F7F3C2912414D93DFF4ED8166CFE056468D457D8831
SHA-512:	EFC76743D23266F1839E740E76084F3AC0D58A5EC16C0C9CBA30B2B50AD713FCD2E16A3C6306E08CF63A6419ED1C564049CEBFBE6DFE721433B479D4BCEF3FAB
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................FastestVPN......................................................................................................................FastestVPN...............................................................................................................................f....................................................................................................................{d........t.^N......s........2.8.4.9.9.2......a.l.f.o.n.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N....................w.. ........................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.F.a.s.t.e.s.t.V.P.N......F.a.s.t.e.s.t.V.P.N......e.n........................."...<........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.B.o.u.n.

C:\Program Files\FastestVPN\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3070013
Entropy (8bit):	6.39701754184779
Encrypted:	false
SSDEEP:
MD5:	A2386053A831B1C65F9BB923F4F17A7B
SHA1:	530BC9411C100138963776A527966EA98D2D1FD9
SHA-256:	3AE0793AF74140734EC43A261FAD664E5871890F28F9CCC692B68B3D6E1A26E5
SHA-512:	2E149D81B13101F9C38EE67396A92527AE5BFD8761D8187BAB635C7736B316E31D9A246DC14D934F28EEE4076F9B3FA78751F912D9CFEB6A032470997382D76F
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf.......................................@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307306421247274
Encrypted:	false
SSDEEP:
MD5:	A9804B11DD7A3B5C0FC46FA9FF685102
SHA1:	478D7B57619C94D01E2D47FE591653303AFE911C
SHA-256:	6DF8416757F8250501D3916C418210D1127516FCA0E0624C2CE5884C4CB40830
SHA-512:	91F6C67DDE4F2ABDB39906BFFCFD535A74528033786ABD490DA565FCE433A2A5E3FF0FF855B0B20FAE9543E45F4CC155F5F569038850CB3FD65EEB99F1ABAFD4
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x40687b02, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585749446923206
Encrypted:	false
SSDEEP:
MD5:	D63A723470ECF6F3356AA61316B88167
SHA1:	D5378C987CFC8AB75698233718B843BFA289A1D3
SHA-256:	039C7CF97628784BE20B0FCE1F08B33262B801E507F799D6D55FACF78936E30A
SHA-512:	05DE73B0D7CB21D302E97A0EF63524AC63E75524AD427072FA4B40FED685DE156C33921FDB4EDCEFE88C302C398C756CAC23F9D4025396362DC1E9D47A97C22A
Malicious:	false
Preview:	@h{.... ...............X\...;...{......................0.z..........{..&....\|c.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................W.&....\|...................iVL&....\|c..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08081847999721575
Encrypted:	false
SSDEEP:
MD5:	B2975F02BCF739D25EB2AD2D5DA36D87
SHA1:	8C3166C77DCE213842FB4BAF56E4A5FB68612F5A
SHA-256:	5D8E3951FAE87DF8924E6EC3147F0E1F88EF6F3D841E09E67896DF15ABD9689D
SHA-512:	A730DFDA87964915EFBABE9455839384B84C6E9363B7641E82112210550F012F7CC908EF63F6F26F6D658FB6FE4FE7F1708F451AA04BF6C7CF8C593A442F13BA
Malicious:	false
Preview:	.\|......................................;...{..&....\|c......{...............{.......{...XL......{...................iVL&....\|c.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:23:12 2024, mtime=Thu Oct 3 07:23:12 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	3.2344966285974817
Encrypted:	false
SSDEEP:
MD5:	696D1BC2811F8ED3D716C70ABC263D4C
SHA1:	52E56D93DAC27D12EDCB72635F83FF790CD7FEB5
SHA-256:	5C73EAE73C8BA47EC59510D1C2E5B767981ECC8A9E5DD79683399936A974CC2D
SHA-512:	2E4C626E3BF1F82B0A49592195C1722371E91CA5BED68C9416B68E928E5B85F64A04825A0EECAC2B2B894775DBD9C6BB349D6441130CCCA6F9575113FFE5C775
Malicious:	false
Preview:	L..................F.@.. ....~.\|m.....\|m......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....*.....................v.(.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X....................C:\Program Files\FastestVPN\FastestVPN.exe..9.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.....................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 3 07:23:12 2024, mtime=Thu Oct 3 07:23:12 2024, atime=Thu Oct 3 07:22:46 2024, length=3070013, window=hide
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.56336895710027
Encrypted:	false
SSDEEP:
MD5:	2FF5FB620E48AF27E55F830A2F7EFCA4
SHA1:	C5BE1B25D56DDFE7C49A968A325CD614E22EBCF5
SHA-256:	92DF0AB05C68C33C257F11C2496A625D2333A5C0FD77A7438408C4648CAA6C5B
SHA-512:	4253690292036A699AF09497B30BB1B34094E9A55FB26FC8098060B3DA9B658D7F9BA1ADFE03453DE83E6AD776FCE44AEDD53EA36816E19E15AABE6D0F88D185
Malicious:	false
Preview:	L..................F.... ....l.\|m...8.\|m.....imm...=............................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....*.....................v.(.F.a.s.t.e.s.t.V.P.N.....f.2.=...CY.B .unins000.exe..J......CY.BCY.B..........................<V..u.n.i.n.s.0.0.0...e.x.e.......W...............-.......V....................C:\Program Files\FastestVPN\unins000.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.u.n.i.n.s.0.0.0...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.`.......X.......284992...........hT..CrF.f4... ...2=.b...,...W..hT..CrF.f4... ...2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FastestVPN.Windo_53ebd9cdf731fce6dc6bf88ca253274667038a7_2affa00b_4c86a5a6-7d54-474e-8f90-7f11a83d8e79\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0628364199037272
Encrypted:	false
SSDEEP:
MD5:	EF2C428F073B3D3F0198F59633838744
SHA1:	3BBB658EF6BEE111E9CACD0D8ABAD5073387D216
SHA-256:	166646C93DD71C028ADF0D2CD7A12244B19EFD0F20FE24AB269134EF02C98C8C
SHA-512:	21FA995583653FE6D94E6B1FCD18A476289ACCC707DD207F431F4F77706598602F0119F7D539E9E2BC202C9418361C8BC06EF6FCBB72E31EF70A3A298AB61CB7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.1.7.4.1.8.1.2.6.3.0.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.1.7.4.1.9.3.0.5.3.0.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.8.6.a.5.a.6.-.7.d.5.4.-.4.7.4.e.-.8.f.9.0.-.7.f.1.1.a.8.3.d.8.e.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.4.c.d.1.3.f.-.d.f.c.b.-.4.1.9.c.-.9.6.a.c.-.e.a.d.e.0.b.5.7.2.e.7.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.0.-.0.0.0.1.-.0.0.1.4.-.4.e.4.6.-.d.0.8.a.6.d.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.7.5.a.5.b.0.1.c.c.e.6.9.2.0.b.8.4.1.1.a.f.c.e.d.8.6.5.7.1.0.0.0.0.0.0.0.0.0.!.0.0.0.0.a.b.1.8.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SearchIndexer.ex_cd53bb3f2f8e47747a257a3577baa06d94df3e33_9e0a92cb_8ac6e945-b2c3-4856-9d1a-426e3a2c40aa\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8087166834421071
Encrypted:	false
SSDEEP:
MD5:	77016ECF1D758A8E2F9D14BBFB392FE2
SHA1:	B1FFC0A8F544673F7427A93063A88F563FAD075C
SHA-256:	242A0EB6D42C044EA0DCFCE32022C4BE823A385B1F5006C038807D16950B680B
SHA-512:	3D8EE9A5A6EDD9250738A35C789CD60FAC3406DCDF2562FDD6F05E257AAF32D97D794BB09810EB324F8541AEC7A7256EE91DEC001C7122A6695D6741FA0AD0BB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.1.7.4.2.8.4.0.7.1.1.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.1.7.4.2.8.8.9.7.1.1.5.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.c.6.e.9.4.5.-.b.2.c.3.-.4.8.5.6.-.9.d.1.a.-.4.2.6.e.3.a.2.c.4.0.a.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.0.d.2.3.f.5.0.-.f.8.4.e.-.4.3.0.4.-.9.d.8.d.-.2.3.0.4.e.b.f.1.e.3.a.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.e.a.r.c.h.I.n.d.e.x.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.d.4.-.0.0.0.1.-.0.0.1.4.-.e.2.3.3.-.d.3.8.c.6.d.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.0.4.6.4.a.9.c.6.7.f.c.b.d.d.9.3.e.b.5.6.9.6.a.9.e.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER35E7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 3 08:23:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	224905
Entropy (8bit):	4.023704476955442
Encrypted:	false
SSDEEP:
MD5:	AF4DC354E81EF1D5D23FA8BE159C2177
SHA1:	0C28714FE0C28A70AB16A0F939358DD5470E6824
SHA-256:	2A1F7FB890E134D8FC6AE8FF0BBBD8587FD2DC161D5DF3FDD59FDB2ADFD5DA0A
SHA-512:	ED3D0A7CBD63D06BF2BD4461C64CB38E313153B3D1870FD13B8E36F38C7C36B1D19B9E112B9E4E79EA698891C07D90CA2031A40761A23F007EFDCECE67EDEA68
Malicious:	false
Preview:	MDMP..a..... ........T.f....................................$............"...@..........`.......8...........T...........h*..!D......................................................................................................eJ......\ ......GenuineIntel............T............T.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3878.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8484
Entropy (8bit):	3.702630054090246
Encrypted:	false
SSDEEP:
MD5:	991185C812540FC1BD70A0E6FF722361
SHA1:	2CA63ED7D8143A03AE92C3E54890CF2D6959A464
SHA-256:	282CAFA94772F25E21ED5B24273286066D2FFB88A7BBDCE595E18A00E4EE6A59
SHA-512:	3815714A252CBBAC317551D9702B4180EF7B8497902FEBDFD4F4CAB2753F343CD1A09F19EDEE0CDC55E0979F21ACC28EEC0F21EB67E1158E72493E71EC714648
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER38B8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4887
Entropy (8bit):	4.553183890804607
Encrypted:	false
SSDEEP:
MD5:	3B78E7916887C4D95703559C5251E4D1
SHA1:	3D2600E0638BBEDF101DC32DB76A510588BF33F5
SHA-256:	D2123B1B593AA56F09F2B7193E6BB0BF3677F9822AD5A4758361BC81B4D3F6F4
SHA-512:	9E6023F5901CD035AD0C9C0A93489190E2870313541F0D7463894AB680DD51E5BE43F47AF536080586B7AFF44A40F353769A0A36F26E4C57111B597F70F996CE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="527006" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER38D5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83842
Entropy (8bit):	3.0756883377683737
Encrypted:	false
SSDEEP:
MD5:	EB4539FC2441583B3393AD70211A7FF7
SHA1:	8E60BA22681C3540BFEEC28F0354AA9C14A424F7
SHA-256:	AA51182584A29BEE0FCE1245ACC5659B12F1D16DEF96E438827C0F1E128A5CA9
SHA-512:	C088AF33C365B78AFAA2E00552270FD84989262DED4ABF922E8ECE82D34850A1A9C331648F45CBF47EB15E73851B9CDAA3EBC467D9E4E5444ECCE4C6968D78B0
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER39D0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6857497678237947
Encrypted:	false
SSDEEP:
MD5:	2289552A63153CE757D8AF2A13EC4F40
SHA1:	6D988A5D51380ABB58348A19E14343F02815CDAB
SHA-256:	674A29D338E5B0C353C5CF44B361DBD4A50BB2862D2D865B71AC23EFF37B7A5A
SHA-512:	34EA6AADB7F77EBEFA2BF4B6D0B0102DB7183B2909E26D2524DF91324C2506A8A9ACEA5DC58BE8A4BE98489C9EBD213CEA4D497439048B4476A785CFE9F810F9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DC2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 3 08:23:48 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	26198
Entropy (8bit):	2.246481566566929
Encrypted:	false
SSDEEP:
MD5:	03356FCDE5ABAF69617E8421DE7D5700
SHA1:	703ED80CC0FEFB2576C8751665F7794DC8C5F7E0
SHA-256:	777B50436D36620351B0DE20434CD8BBABA28FBF7C2F3323F93BF06934342B6B
SHA-512:	6814301673835A6DEA22922E15CE5BF03259DF446DF9E7ED86F6A0CF75B0293A20CA1C16EF748D1227ABF93225A7A9E4E5831AA133BBA2ADBB1865D0D89F0F49
Malicious:	false
Preview:	MDMP..a..... ........T.f............4...............<.......d...`...........T.......8...........T...........X....S......................................................................................................eJ..............GenuineIntel............T............T.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E30.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8292
Entropy (8bit):	3.6949875316268654
Encrypted:	false
SSDEEP:
MD5:	FD5DC37B5412432D17144797D09E9BFB
SHA1:	FD506071399EB8E75D031D4E7190E939775CE37C
SHA-256:	FC0672016F65C8313D2A7FAA0CBAD12933D134E6F3569044BAEA147951C304D5
SHA-512:	623614912CF96F758A12B323A7E549E655AB37B1AE95B1A2333F096D6930062F5850BE22E5C6205F0116B5B26A2359CF49B531F3CD46B73DF316A66ABA060FDB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.8.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E60.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.488234256641139
Encrypted:	false
SSDEEP:
MD5:	B56DEEAE7D9DC816FDD5A75D5D9D2767
SHA1:	B8A0699672C8D53F49C28020763997B8AE21C416
SHA-256:	D2F5C2369702917C884A5C50309CEFC63CB7F961F57995C628C81730AA5BCDF6
SHA-512:	01222A3FCA8E1ECE9402504DD41B3F30B64E6A0BD057B2D5F533D7F0700C112BFF969061AAC088054EA7413BD56848466ADBB154D086DBFF7FA875F83B5EF807
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="527006" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E8F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	84278
Entropy (8bit):	3.075234489185559
Encrypted:	false
SSDEEP:
MD5:	E5074C0CB67C673F8CB9276DFA332433
SHA1:	2E24F8125243EB75B212C49F9B39492A3167D941
SHA-256:	FAD7D15E1E5495E487C5AEC6241417957607DD324F600BEE481C99557F47F4C3
SHA-512:	CB28BF60A610C9F1DD5D2A2F26357783A204CF798AE49ED320CE2B6B6E78C6FC039FBE6D21B4939CD113A385F66574FD1A8629B4B4EF4E56E187E35F54DB93F3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F6B.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6856424600297184
Encrypted:	false
SSDEEP:
MD5:	A5927BB09063BA3D76381D625E0D20CC
SHA1:	C578E45E04746DF8536DDF32E17425B320169477
SHA-256:	2BA64478D293558F7B65A5744A3B187107C17285988BC8FD5DC0AA5D5EBFF768
SHA-512:	3A11DE4508CE8D6AA3800E60FEC26A3FE18C2AAD7AD413EFE7EAA206DF306D7A0C71BD684EF086463FB141895D8D99FEC4801E3D73DD8CAEE6680FC34BC96A43
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\Public\Desktop\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:23:12 2024, mtime=Thu Oct 3 07:23:24 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	3.2306891377193763
Encrypted:	false
SSDEEP:
MD5:	A8193FC9F09CD64A36D618BDBCE50C29
SHA1:	26BC210329F29A4CACBF6B3CCB768B5D21FBAB30
SHA-256:	14FFC782D55391903EF8F7EC5DBF53A6F988CB8AA08C0396852A93A17AD69047
SHA-512:	EFF1BD479904DBD005C4CE3F4D9B10FDCF52001F65139D5349D253E5048F509810280F40259D8C307C7259D5EED53835EB73DE043C763B99C0DE4A2732BA9946
Malicious:	false
Preview:	L..................F.@.. ....~.\|m.......m......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....*.....................v.(.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X....................C:\Program Files\FastestVPN\FastestVPN.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.......................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.052898866971229
Encrypted:	false
SSDEEP:
MD5:	402D0C8031EC738D2F59EC8A20988930
SHA1:	5B5BB6A211D68B92C9C11EBFF87541909CF7D1A6
SHA-256:	B5BCADD0FE0C262B9982BDC924C52361AFBCD2C0079CC61BA8424111B1245A7D
SHA-512:	F32523A51E1FAFFA75B66F40A1F45B1D3EA67EE24A4FD5CED1033B2791590BF1A82423BF64568D429CC4ED15F87A6EE0AD31A3BA9B51E658CF081B36D42C6567
Malicious:	false
Preview:	p...... ....l...y...m...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\4n2a3oxb.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.807606594598902
Encrypted:	false
SSDEEP:
MD5:	183EBDEC24DDC45FF5E38C915A0F1F2E
SHA1:	E1FFE9DA68D9F934FD66E0EB15857C9C1F9BC48D
SHA-256:	6165A855053058DA8ABDE8798FABCD9F0E6ECAD175E52A3DFE0F3CF081C82E4E
SHA-512:	41F7B750B6CE0B096A3D5FD7ECF6CD1E222C7B26C4FF3F0463B1AAB2D5718245CF4A91AB396B02ED8B125A55E62574D5E11949B95C5A636899CD1A2F4F795D06
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\AppCenter.config (copy)

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.816940765206284
Encrypted:	false
SSDEEP:
MD5:	90401247D5A6AF2729E2F23FBA0A6351
SHA1:	977D37740A245C9A41AD5B8916C07A699B181A09
SHA-256:	C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
SHA-512:	1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\flevcnhn.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.786578375552194
Encrypted:	false
SSDEEP:
MD5:	9BD7587F34E11ECFAD8B5DEEED8364B6
SHA1:	93765EE7A4A27B2F84134001FAAB307984BD58BE
SHA-256:	B9870C1A6239C96F710CEB8B8E21A745433A8C8151B0D2FD9C17A0D2C4AB1C29
SHA-512:	7B0B26DFE2CD19BF210AE3E916D95D9EE97D6677C11979D2F8787C2EC9F682FC52078B4D126BC4671661CFD98EF8D7C9AE18F9AE5F8D6DF141F8B25B52A5D5C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\httt5xir.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	392
Entropy (8bit):	5.020074123492841
Encrypted:	false
SSDEEP:
MD5:	A50378064536F76D21C3BD5F4EA0D4B3
SHA1:	B9AF83235445FAA4E531103A3FE78D6C3C36E7B5
SHA-256:	24055B628F6885160189CA64DB7C184C1DEDDFBE8154643791DE2C728C3CF268
SHA-512:	9A74F676A4ED83C1468E8017D16D3EBFACDDA18C54A47AF53E8184EC75937E961943D6F4D87CEA4631123407AEEA5A3B762A970EEA14166612DB112CAA2F4194
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="786d8725-1199-472c-9565-80454ef68581" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\klz20inu.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.0091612126277445
Encrypted:	false
SSDEEP:
MD5:	08206D5972739EEBADE524BE09599E22
SHA1:	D81322BCB0AFF14FDB79DAA5F398130AC71D0415
SHA-256:	102D081ADB65CDF9AF4085C54054F176C6F6B46A957DFC57716515684ED2391C
SHA-512:	9EEF87FEDFBAC3FA145F51EDDDB358A5EA9C538B6ED8A259A0A6D426F3F910F37F3A99FD7A7DB0E163B7186D06E8F5F33902370BDE942894D9DEF57614CF170D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="786d8725-1199-472c-9565-80454ef68581" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\ogvnb040.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.022337497103199
Encrypted:	false
SSDEEP:
MD5:	0E4CA5A28EEA03E1AB25E1B8DCCB4539
SHA1:	068F0A9E64A766531646695A36CD7334A9460EE5
SHA-256:	0E8A3789D6EBF6CDE4E1FA37CD2CADEA1017614B03CAA8F75D6AE51F9D78B101
SHA-512:	DAEB53F2D28BE11991344A438AF38696C1DAC8ADB3E15FD0D1F4DD68A96A6C7881FF5125CBD0778240B7D89BD7F4540D190CBECCC5ABB565C8AE145A89C60915
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="786d8725-1199-472c-9565-80454ef68581" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\t033zpn2.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.816940765206284
Encrypted:	false
SSDEEP:
MD5:	90401247D5A6AF2729E2F23FBA0A6351
SHA1:	977D37740A245C9A41AD5B8916C07A699B181A09
SHA-256:	C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
SHA-512:	1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\wx2eo43m.newcfg

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	390
Entropy (8bit):	5.015880346432943
Encrypted:	false
SSDEEP:
MD5:	E7B61EDFA28C4F4ED15AC4A9B73FAAF0
SHA1:	CDBF86B8AB6E045B8C41706A229ACCF0D669A838
SHA-256:	5B2EA55A3197687F6F815EA0011097BA230E6F061EE020F4C51D1E5A9590D64D
SHA-512:	35AB9FA288156A25B3767470C26B32C4D36157067E99EB0A625135CA6AA27AADE6FAB74752962C4FB79BCA5B60F74A9E5B7ECB4DC39EBEDBB8AD4CC5609274D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="True" />.. <add key="AppCenterInstallId" value="786d8725-1199-472c-9565-80454ef68581" />.. </appSettings>..</configuration>

C:\Users\user\AppData\Local\FastestVPN\localdata.xml

Download File

Process:	C:\Program Files\FastestVPN\FastestVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	5.190490363715085
Encrypted:	false
SSDEEP:
MD5:	770A9E878C690857807301C669D8002B
SHA1:	EAEB35A2A438ADEE17B4020D4832355769EB2013
SHA-256:	F54977607FE77962DC2E7CC4FC0AED2990D25A249E58AA9813F42EFD0CF51200
SHA-512:	1E223D5C4213517B3400B887F320E42F19BC3C3F974ED4A4FBFA48157E2D5030BDA6DD9800A477DBE7FD8E76860DC24EE947F1FD9EE67294A5A9A6C1E8666CD3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Settings xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">.. <SplitTunnelingStatus>false</SplitTunnelingStatus>.. <HasSeenSplitTunneling>false</HasSeenSplitTunneling>.. <ConnectOnLaunch>false</ConnectOnLaunch>.. <EnableAdBlock>false</EnableAdBlock>.. <RedialOnDrop>false</RedialOnDrop>.. <IsIKSEnabled>false</IsIKSEnabled>.. <IsConnectFallbackEnabled>false</IsConnectFallbackEnabled>.. <IsMinimizeLaunchEnabled>false</IsMinimizeLaunchEnabled>..</Settings>

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.WindowsService.exe.log

Download File

Process:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1803
Entropy (8bit):	5.3407719505798275
Encrypted:	false
SSDEEP:
MD5:	077007B5E9C8A61A51283FAC0B0B1260
SHA1:	F9EABAC9D0664999C4D46AEB57C99D9041FD7F49
SHA-256:	DD99B5C1E5B54D11E9BE692C4201D18FC5CF4764B5EFFA232EFF142617F9EA2A
SHA-512:	007E65ABAA38E36B0DD4DD58EDFFDD4538B0F6D269F7067FEED2176DE1971EACF39E0E4BCF4365A383765C1DD49DDD2BFFA044EF94A8B50BB4270A17B74411FF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.X

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	5.412110985679191
Encrypted:	false
SSDEEP:
MD5:	BDCA12A5BFD7321172C1300F1E0FD10C
SHA1:	0B7DC99D6203614D1008F7C037A6F04F7DD55B14
SHA-256:	F5B9722B65B136CBF7E5901D8D14D95CE3240650C90F7374FD74D2CB5A236116
SHA-512:	43333F06BECCAEDE33F31C98F0EC5BE037CCFC6CD8A23E8ECACA3297573A4A5CE1B9640D2B18334FB08A7B0FB22D8B03A497330CB7DCF9E91DBAA3DA52C4FB4F
Malicious:	false
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13knu4jv.2ko.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eu4toekb.3ex.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\f9c52751

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	PNG image data, 4064 x 340, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1075019
Entropy (8bit):	7.995986448343732
Encrypted:	true
SSDEEP:
MD5:	3F4310D49A7F77CAF6BD8BB44914E795
SHA1:	861BE741EBDB486FCD8AF06EC7F478BE8F82B8B1
SHA-256:	0CF1B6B5687415103900DA176EBEE19DC991000E8194D209BC514E00B7861790
SHA-512:	8A05B0A2715EF228AD470977F7C6AAACA03DEE9ADE777CDDA0F89343465A4FF0378196018C96689637C2ADD6853F4EAB20D715AB568C1F237A0017D69D714781
Malicious:	false
Preview:	.PNG........IHDR.......T.....!.S... .IDATx..]y............./h.(&F....Y.b..Q..b.F0...0..@.k...."F.(.....;.q7...k.f..k{......W....4../.........s.;..../..D.@...HHHH..d.?....B..PJ!.e......z\|).G.../.0d^..A.\....!s)UU...[.E!...0H....o..2oQU5^=..EQ....i......3......i.^.Y].4\..<. H.._.R..i........{...:..y........!.....i...k...R=PT.w>..f.qu..z#.m..[$$.A.}..........B2O.M..$.R..(.....@S.....P.$.......N.?X.H>.J..W....N M...J.....j.A)...6jQ..Qb.W+..s.U .!....3d- ..B.C..Z...~.3....'...l...R..........H~.....+....H.$..Kt.%j....W..5...t]...V...z...... .W..n....5UQT...".h..@.0...6f.#.G.x. ...........B...5....u.G...EP...:. ..a n.g.\|..y...x).76B..?..!.`7...9..D.@.. ...2s......O.qu.....\|.$......V....H.\|../G,.(....B....j!.1\|..3......._.O1._/I.$.....q.1.O.I.J....W..d.\|N....'..........T&....@.O)?.Pa.a `..\|.......!J],_.5.:Y>.X...)...H~.! ..F.....Jx....PJ.j....o...]B.......I. ...8...\..Rg.....=..O....H._......4.k..WTES5....xV.=....<.......I>a...)p4]SHeu...0......h$@

C:\Users\user\AppData\Local\Temp\fa9cd5dc

Download File

Process:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
File Type:	data
Category:	dropped
Size (bytes):	1040023
Entropy (8bit):	7.561830292196214
Encrypted:	false
SSDEEP:
MD5:	88CFA4505ACF947A1C228DB25F674992
SHA1:	ECF62F3AB0274D536D08F31C206908A3E26B194E
SHA-256:	75294136BB5CCD170E0B55DE23D3AAD400069D65B21D00E6EE969B4CF653DC1E
SHA-512:	0D9299029639AF9749D4505A4B4D7BD4CE6333A0561FA25B165224577288EB0035D011F30D9DC08429CDC9F1CB419B2B1593008E63F4E05C4428CB8BFFB9A2DC
Malicious:	false
Preview:	Y3J%Z3J%Z3J%Z3J%[3J%.3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3K%.r.u.r.d.o.L9A%V5U>y.Z$A5D9y.G+W...@4F.u(\-W;^9y.G+W.F:%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%.\.K3G#D6Z0@.KJ%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%.\.W?R>@.]9Q;])@Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%.d.k.z...~#F(\9J<Gdk.g.c(R'@-\8NZ3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%,.d.t.z.h.J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%Z3J%

C:\Users\user\AppData\Local\Temp\fqik

Download File

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314880
Entropy (8bit):	6.725012280631594
Encrypted:	false
SSDEEP:
MD5:	B42490E2867AA7A201A6D15804726C84
SHA1:	87C2CD0F5CDC1C468749E0F31F1E24963DBB8081
SHA-256:	5EDA8ED7AD5AB1A39A26A692A1D56714B15F214A547629DE93AC009019BFEBFA
SHA-512:	5B0BB0301FAF54064ED6E2239AAC3AB8481DF271FEA8018F53BEAE1106D98DC68F35F59A46912A01E4C2563AD12B5383B3A8D61F2E99066AD9F5365784C8AA2C
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......Q............................@.............@.......................................@.....................................x............................ ..xM...................................................................................text............................... ..`.rdata...*.......,..................@..@.data...............................@....reloc..xM... ...N...l..............@..Bfre...... ...p......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KIVL3.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp

Download File

Process:	C:\Users\user\Desktop\OqAVRCkQ3T.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3045888
Entropy (8bit):	6.41066353205617
Encrypted:	false
SSDEEP:
MD5:	259E3EE4646FC251C3513EEF2683479F
SHA1:	BE09457567F0562E8942A28BD90759F6DCE6DCB5
SHA-256:	BD9F32A9B7B9663A3AFDD1DC0CCC3D6423783B360DB341691FE2FE71C543EC53
SHA-512:	56607419EF2E2F98A8DAA6478DEA4B49925F4A17AB649E450F34331490281E2FCF976F17813F1A80FA460EE258C02901528A43B508093098135C1FADB5902B24
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf.......................................@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\SET106D.tmp

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\SET107E.tmp

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\SET108E.tmp

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\oemvista.inf (copy)

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\tap0901.cat (copy)

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\tap0901.sys (copy)

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:23:12 2024, mtime=Thu Oct 3 07:23:24 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	3.233717938195197
Encrypted:	false
SSDEEP:
MD5:	84F339F3FF90400528935AC8E8E5457B
SHA1:	47045BF85FC3683DE0F32455642CC19C324F209E
SHA-256:	6B1C127FFEB22D9D9D5D674DA969197E5C01607326C4D5CE7B4FEA2E54149549
SHA-512:	ADBB3856E542A3CCBD424F174E7D2C9983B3C6FB0766A1B9E342FDEF38C07B00CC04737B4AC728E4A53FC3420D86DDC9A5EF4344BE2695B79E0DA8682F66BF18
Malicious:	false
Preview:	L..................F.@.. ....~.\|m....i..m......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....*.....................v.(.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X....................C:\Program Files\FastestVPN\FastestVPN.exe..<.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico...............................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Oct 3 07:23:12 2024, mtime=Thu Oct 3 07:23:24 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
Category:	dropped
Size (bytes):	1801
Entropy (8bit):	3.2481433014198866
Encrypted:	false
SSDEEP:
MD5:	FC7B13205E276EF74AF6109368823832
SHA1:	FE1F4E81CD027061006D5C969A2D41C20D06F0C5
SHA-256:	99331F10C95C54460278D52A84382013C27CD6C5F54444695F3B820814374F94
SHA-512:	18563173F1DBE2413731D79ED20401371E4E494B60F495230C81FBB20A976D9D879F66277A06FC3045BEC788343E3D8CDA72FA6D4B699F40A353C160EE433136
Malicious:	false
Preview:	L..................F.@.. ....~.\|m......m......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....*.....................v.(.F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B..............................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X....................C:\Program Files\FastestVPN\FastestVPN.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N...-.a.u.t.o.r.u.n.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	58712
Entropy (8bit):	5.206637545410206
Encrypted:	false
SSDEEP:
MD5:	5720F1B7A8F2ED8A458459A4F8CC4B4D
SHA1:	54CB1B2E841AEAA60D5120E58F2A841C2D468BD5
SHA-256:	B4711091EAE5C671EA744DE68FCC62C7C2266A6C1193409A328C2F95B660C995
SHA-512:	BC36CFF886168093D7C9E807A7BF86529262EDB28658F11D1C80AB479E0260FC0343EFFDF87EC92CACD8FD44011287862FB09603CBFCC7AAE4006F864A5EB778
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	524288
Entropy (8bit):	0.4240181243902626
Encrypted:	false
SSDEEP:
MD5:	CBB5E9A4875C57AE51D2722B3650C95E
SHA1:	F58D9CE3AD4E4CF6FD156CDE3DBF05B8A6869B24
SHA-256:	343A227C662BA83D31CC3EB448AC27C10F7442DA3E6955FDD3C9F25F44DB63C7
SHA-512:	E8EC617D021BC60943D867C33D0BD3E9D8720077ECE769D89EB6367F0D62453DF95C9E7C12ACE0B81183009214F46CA2D85EBE875808C7B98AF1F7E7BA48D5A8
Malicious:	false
Preview:	....8...8...........................................!....................................?......................eJ....../h..m...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.db......4.@..?.........E_iC...F........NetSetupSvc.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET134C.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET139B.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\SET1409.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\oemvista.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	7537
Entropy (8bit):	5.046488463217706
Encrypted:	false
SSDEEP:
MD5:	50D29CA2E3DDB8A696923420EC2AC4FA
SHA1:	D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
SHA-256:	817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
SHA-512:	03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2002-2014 OpenVPN Technologies, Inc. ..; This program is free software; you can redistribute it and/or modify ..; it under the terms of the GNU General Public License version 2 ..; as published by the Free Software Foundation. ..; *************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*******************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	10711
Entropy (8bit):	7.2254581318251425
Encrypted:	false
SSDEEP:
MD5:	225E7BA0E5E2D46813E5C858A4D0D5B0
SHA1:	5DD49014764F634164520583FD0CEC87AB1A1625
SHA-256:	B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
SHA-512:	9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
Malicious:	false
Preview:	0.)....H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

C:\Windows\System32\DriverStore\Temp\{927e9f0e-4e66-fa40-88d0-fe9e48ac6e39}\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3475
Entropy (8bit):	5.365029584369047
Encrypted:	false
SSDEEP:
MD5:	B8BE6FFF474ED448ED7906E95014486F
SHA1:	D7F564701F58B373ADE406493ABABF8BF3C14EEE
SHA-256:	A75A9C75DAB148FABC9399F596CD177DC4308809662340AE0D805899BC71C715
SHA-512:	9D2551F92DE87FEA967CC11BEDF336A6EAE1E0096A7958F05FCF3B6F0E1B3A380093A6676453BD73B99D67BFFBD1BD3AAB4FC30CAEBEC0142F75CA2980D2A1A0
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SET1ED5.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\System32\drivers\fastestvpndriver.sys

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	104424
Entropy (8bit):	6.366713641084616
Encrypted:	false
SSDEEP:
MD5:	95FD4F27F82A9E4D6E2A53AF7A9096E6
SHA1:	5F772C89901841AF1814C858359AC5FEB9BE3C24
SHA-256:	98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
SHA-512:	6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Windows\System32\drivers\tap0901.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39920
Entropy (8bit):	6.333649052940754
Encrypted:	false
SSDEEP:
MD5:	059E578D456043A8C3B76EC365B375F3
SHA1:	42189B6A1B8C736397113BFC2283F5E1E1A44E8E
SHA-256:	A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
SHA-512:	99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..\|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.425438750083649
Encrypted:	false
SSDEEP:
MD5:	69B283C2CDAA05D9630909CBB91CAB68
SHA1:	BD1CC6DFC6C006D3F1CEFEEBAAA1E78F7DBF891E
SHA-256:	D92302A0D493635B4DF77EFE1A3AD5CA21B2DDA35CE8DB6DBD89A896343A5C8D
SHA-512:	28910991769D9EDE58D5D92F7F2F8D2AC0DFDD02DCFD89D6B3CA2642EF5AD511EC16DC9E52EDB5426B25EE0F8DF8A517D496D1ECFB53E25CD187C2C49D70A942
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm./.m...............................................................................................................................................................................................................................................................................................................................................a..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files\FastestVPN\subinacl.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	133
Entropy (8bit):	4.004784065185313
Encrypted:	false
SSDEEP:
MD5:	CE8AE87D7F83FA032F2A60AB0B8F0FE4
SHA1:	203E8416D17D3A9E03509009A8F20F94C51C0381
SHA-256:	F3617B3A17F48864D33A4C32D4F9AE862B23E07F35504C8D4DBE79AC589D395D
SHA-512:	091E97EA19CCF4D6870F8EA861DCCC0F87E4928AC39C64A2AA1085C94EAE5F6707919A18FB3A56EE94F7483950F34128E7E8D321129F810C0847F3493F269682
Malicious:	false
Preview:	.Elapsed Time: 00 00:00:00.Done: 1, Modified 1, Failed 0, Syntax errors 0.Last Done : FastestVPNService.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996342803371446
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	OqAVRCkQ3T.exe
File size:	30'699'768 bytes
MD5:	6d6a207d5513fa5ac6ead647f5d66a6a
SHA1:	913e0d1aadbc1593b76f6442bb89070bc4a5e224
SHA256:	649ec4858e572e0145e35a9faa712708949b7bb1bce1594154cda580d80a0ca9
SHA512:	ba7afc2ed1989758fa6da17407d81cf81c93fe3d0c7f896c03c2ac793551a3d9c26915d9f93d658644b7429647bb0a913d0e438ce6c429700cd8e2d998d0eace
SSDEEP:	786432:lEKDCFe7MJ0y1mLlV8zKFT8ZQ2eoq6QY09C1a:lEACM7MfsL0KFT12eSr09Ck
TLSH:	63673322B2C7E53EF0591FB306A2E050A4F76E516512FD5789F8B878CF314622D3E61A
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	701e0760791c0641

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x666711EF [Mon Jun 10 14:47:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	15/01/2024 21:45:41 14/01/2025 21:45:41
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization, CN=Acira Consulting Inc., SERIALNUMBER=987024-5, O=Acira Consulting Inc., L=Mississauga, S=Ontario, C=CA
Version:	3
Thumbprint MD5:	4C9BC68042EB932BDCEC05026258C237
Thumbprint SHA-1:	A70AB688FF0A7C3A22B030FBFFA8B56DC31F650A
Thumbprint SHA-256:	49EB14C9EFDE16BD0546A80F058C7D10871ADACFD3B550A4F7007080377DA3BA
Serial:	748A88467D46DF98B5246AFC4F5EEC64

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FA7152ABC75h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FA71533D5FBh
call 00007FA71533D14Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FA715337E28h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FA7152A5D23h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FA715339153h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FA71533D683h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FA71534436Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FA715339A48h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x7088	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d44aa8	0x2650
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x7088	0x7200	549b47e0a2b698414657cad4df93aaa2	False	0.2584978070175439	data	4.423634621918959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xba498	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3980496453900709
RT_ICON	0xba900	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.274155722326454
RT_ICON	0xbb9a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.16514522821576763
RT_STRING	0xbdf50	0x3f8	data			0.3198818897637795
RT_STRING	0xbe348	0x2dc	data			0.36475409836065575
RT_STRING	0xbe624	0x430	data			0.40578358208955223
RT_STRING	0xbea54	0x44c	data			0.38636363636363635
RT_STRING	0xbeea0	0x2d4	data			0.39226519337016574
RT_STRING	0xbf174	0xb8	data			0.6467391304347826
RT_STRING	0xbf22c	0x9c	data			0.6410256410256411
RT_STRING	0xbf2c8	0x374	data			0.4230769230769231
RT_STRING	0xbf63c	0x398	data			0.3358695652173913
RT_STRING	0xbf9d4	0x368	data			0.3795871559633027
RT_STRING	0xbfd3c	0x2a4	data			0.4275147928994083
RT_RCDATA	0xbffe0	0x10	data			1.5
RT_RCDATA	0xbfff0	0x310	data			0.6173469387755102
RT_RCDATA	0xc0300	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0xc032c	0x30	data	English	United States	0.9166666666666666
RT_VERSION	0xc035c	0x584	data	English	United States	0.25
RT_MANIFEST	0xc08e0	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 10:23:51.442531109 CEST	1.1.1.1	192.168.2.5	0x3662	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 10:23:51.442531109 CEST	1.1.1.1	192.168.2.5	0x3662	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:22:46
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\OqAVRCkQ3T.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OqAVRCkQ3T.exe"
Imagebase:	0x400000
File size:	30'699'768 bytes
MD5 hash:	6D6A207D5513FA5AC6EAD647F5D66A6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:22:47
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-NCD3D.tmp\OqAVRCkQ3T.tmp" /SL5="$20440,29832184,735744,C:\Users\user\Desktop\OqAVRCkQ3T.exe"
Imagebase:	0x400000
File size:	3'045'888 bytes
MD5 hash:	259E3EE4646FC251C3513EEF2683479F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:23:25
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\ComDebug.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\Resources\ComDebug.exe"
Imagebase:	0x400000
File size:	196'157'514 bytes
MD5 hash:	F892887D8532D19F74884CDC48B1AC8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:23:25
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
Imagebase:	0x7ff7bf000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:23:25
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:23:25
Start date:	03/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Imagebase:	0x7ff708400000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:23:25
Start date:	03/10/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "x86"
Imagebase:	0x7ff616390000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:23:26
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ver
Imagebase:	0x7ff7bf000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:23:26
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	tapinstall.exe remove tap0901
Imagebase:	0x7ff6cb9d0000
File size:	507'728 bytes
MD5 hash:	E313336C82EB265542664CC7A360C5FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:23:26
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
Wow64 process (32bit):	false
Commandline:	tapinstall.exe install OemVista.inf tap0901
Imagebase:	0x7ff6cb9d0000
File size:	507'728 bytes
MD5 hash:	E313336C82EB265542664CC7A360C5FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:23:28
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x8c0000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:23:28
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:23:28
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	04:23:28
Start date:	03/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{31188e45-00ef-574a-b678-058228a97b23}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
Imagebase:	0x7ff61fe60000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:23:31
Start date:	03/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000158"
Imagebase:	0x7ff61fe60000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:23:32
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:23:33
Start date:	03/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
Imagebase:	0x7ff7bf000000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:23:33
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:23:33
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop fastestvpndriver
Imagebase:	0x7ff6d3a40000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:23:33
Start date:	03/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
Imagebase:	0x7ff708400000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:23:33
Start date:	03/10/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "x86"
Imagebase:	0x7ff616390000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:23:33
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:23:34
Start date:	03/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Imagebase:	0x7ff708400000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:23:34
Start date:	03/10/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /i "Windows 7"
Imagebase:	0x7ff616390000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:23:34
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\FastestVPN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
Imagebase:	0x5a0000
File size:	2'059'432 bytes
MD5 hash:	01CF6EF766C41BB2C99A2CCCDECC69C1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	04:23:34
Start date:	03/10/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
Imagebase:	0x7ff79fa70000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:23:35
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
Wow64 process (32bit):	true
Commandline:	release\nfregdrv.exe -u fastestvpndriver
Imagebase:	0x400000
File size:	61'064 bytes
MD5 hash:	9333F583E2D32A47276DCEC7C2391FD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:23:35
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
Wow64 process (32bit):	true
Commandline:	release\nfregdrv.exe fastestvpndriver
Imagebase:	0x400000
File size:	61'064 bytes
MD5 hash:	9333F583E2D32A47276DCEC7C2391FD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:23:35
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" stop FastestVPNService
Imagebase:	0x7ff6d3a40000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:23:35
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:23:36
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
Imagebase:	0x5f0000
File size:	25'768 bytes
MD5 hash:	22D4E4267DFE093E5E23C2F3D7741AA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:23:36
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct \| Select-Object -ExpandProperty UUID
Imagebase:	0x760000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:23:36
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	04:23:36
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:23:36
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7136 -ip 7136
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:23:36
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:23:37
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 1076
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:23:39
Start date:	03/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	04:23:39
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\SearchIndexer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\SearchIndexer.exe
Imagebase:	0xff0000
File size:	711'680 bytes
MD5 hash:	CF7BEFBA5E20F2F4C7851D016067B89C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:23:48
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4820 -ip 4820
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:23:48
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 384
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:23:57
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" delete FastestVPNService
Imagebase:	0x7ff6d3a40000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:23:57
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:23:57
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
Imagebase:	0x370000
File size:	25'768 bytes
MD5 hash:	22D4E4267DFE093E5E23C2F3D7741AA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:24:01
Start date:	03/10/2024
Path:	C:\Program Files\FastestVPN\subinacl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
Imagebase:	0x1000000
File size:	301'224 bytes
MD5 hash:	4798226EE22C513302EE57D3AA94398B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:24:01
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:24:01
Start date:	03/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" start FastestVPNService
Imagebase:	0x7ff6d3a40000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:24:01
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	34.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.1%
Total number of Nodes:	149
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 007A5076 Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A5016: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 007A50DA

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
Instruction ID: ecec4ac57bf6939f374556d3d40ae5e0ecfc7c4599a5ab985cb055a812a83a37
Opcode Fuzzy Hash: af0b5cb85ebff21ad004f17c148dcb155806cd6198d72419ed993a28eb2c6b99
Instruction Fuzzy Hash: 5B51CA75D00609EFCB04DF98C881AEEB7B5BF89300F608659E915A7340E779AE41CBA1

Function 007A5796 Relevance: 5.5, APIs: 3, Instructions: 995
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(?,00000A46), ref: 007A587A

Part of subcall function 007A5016: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046

Part of subcall function 007A4586: LoadLibraryW.KERNELBASE(?), ref: 007A45B7

VirtualProtect.KERNELBASE(?,00000000,?,00000000), ref: 007A636B
VirtualProtect.KERNELBASE(?,00000000,00000000,00000000), ref: 007A639E

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID: AllocGlobalProtectVirtual$LibraryLoad
String ID:
API String ID: 1966084984-0
Opcode ID: 12cd21608a8ffc2380a32fe6fd1c4dfdad82edcd5fa0718e4e7579e87a8b5082
Instruction ID: 3096e990fbc51fd64195844693f64d8de93f73d6e5d797c51f139c1c42e76b70
Opcode Fuzzy Hash: 12cd21608a8ffc2380a32fe6fd1c4dfdad82edcd5fa0718e4e7579e87a8b5082
Instruction Fuzzy Hash: 2892D9B6E00208EFCB14DF98C995EEEB7B5BF89300F1482A8E509A7341D635AE41DF51

Function 007A4956 Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 007A4978

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
Instruction ID: 58118b3da7fea3451b422f2ccd57aaeeb0ace35ac84946a200364d98139f1e44
Opcode Fuzzy Hash: f2ed564a57136dcdfd9afc14d4280a279a6561515fd8f8e06747ede3fd6620df
Instruction Fuzzy Hash: 7731CE75A00108FFCB04DF98C881F9EB7B9EF89310F20C298E918AB391D675AE41DB54

Function 007A4F46 Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 007A4F68
WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 007A4F96

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: 91b13f61e0711d32a8d6f1a9f0c68990d0198dbfd7cbf3d9cc4a0db334215ca1
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: DE01ED75640108FFDB10DE98CD51F9EB3B9AF89314F20C255FA189B291D671EE02DB90

Function 007A4586 Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A5016: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046

LoadLibraryW.KERNELBASE(?), ref: 007A45B7

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
Instruction ID: 7525c6b059c7ab7a83cd6e04e47a4f40b3332f4344eb90b26d38d25042b5bf01
Opcode Fuzzy Hash: f0635a325a859858965f79386bc2292b2c6fb1dc49c835a5e9fb86d575d4b663
Instruction Fuzzy Hash: B3E0E575E00108FBCB40DFA8DD4195D7BB8AF89311F108154F90C97340E531EE1197D1

Function 007A65A6 Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: a85574cd5c8ba9c595d30cbb44e8738396a7fd6de8e8bbab08dc7b6a4a1af662
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: 0191F7B5D10209EFCF08CF98D890AEEBBB5BF89304F148659E515AB351D734AA41CFA0

Function 007A5016 Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 007A5046

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: 6820dd22f81b42863c6f4fbae50cc68872d830e8d0dd4b689b7411f7eb512b86
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: 4DF02278614209EFCB48DF58D580959B7A5FB89360F10C299BC598B341D631EE81DB94

Non-executed Functions

Function 007A3000 Relevance: 36.9, Strings: 29, Instructions: 626
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

EVP_PKEY_meth_set_sign, xrefs: 007A3611
EVP_PKEY_CTX_get_keygen_info, xrefs: 007A35AB
HMAC_Init_ex, xrefs: 007A36F4, 007A3729
EVP_PKEY_meth_set_paramgen, xrefs: 007A35EF
EVP_PKEY_meth_set_signctx, xrefs: 007A3644
EVP_PKEY_meth_set_verifyctx, xrefs: 007A3655
OBJ_nid2sn, xrefs: 007A37B5
ASN1_INTEGER_get, xrefs: 007A37D7
EVP_PKEY_meth_set_encrypt, xrefs: 007A3666
EVP_PKEY_meth_set_verify, xrefs: 007A3622
EVP_PKEY_meth_set_derive, xrefs: 007A3688
EVP_PKEY_meth_set_ctrl, xrefs: 007A3699
EVP_PKEY_meth_set_verify_recover, xrefs: 007A3633
EVP_PKEY_meth_set_decrypt, xrefs: 007A3677
ASN1_INTEGER_set, xrefs: 007A37C6
EVP_PKEY_meth_set_cleanup, xrefs: 007A35DE
HMAC_CTX_cleanup, xrefs: 007A3771
EVP_PKEY_CTX_set_cb, xrefs: 007A3589
OBJ_nid2ln, xrefs: 007A37A4
HMAC_Final, xrefs: 007A3716, 007A374B
HMAC_CTX_init, xrefs: 007A36AA
EVP_PKEY_meth_set_keygen, xrefs: 007A3600
EVP_PKEY_meth_set_init, xrefs: 007A35BC
OBJ_obj2nid, xrefs: 007A3782
EVP_PKEY_CTX_get_cb, xrefs: 007A359A
OBJ_nid2obj, xrefs: 007A3793
EVP_PKEY_keygen, xrefs: 007A3578
HMAC_Update, xrefs: 007A3705, 007A373A
EVP_PKEY_meth_set_copy, xrefs: 007A35CD

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID:
String ID: ASN1_INTEGER_get$ASN1_INTEGER_set$EVP_PKEY_CTX_get_cb$EVP_PKEY_CTX_get_keygen_info$EVP_PKEY_CTX_set_cb$EVP_PKEY_keygen$EVP_PKEY_meth_set_cleanup$EVP_PKEY_meth_set_copy$EVP_PKEY_meth_set_ctrl$EVP_PKEY_meth_set_decrypt$EVP_PKEY_meth_set_derive$EVP_PKEY_meth_set_encrypt$EVP_PKEY_meth_set_init$EVP_PKEY_meth_set_keygen$EVP_PKEY_meth_set_paramgen$EVP_PKEY_meth_set_sign$EVP_PKEY_meth_set_signctx$EVP_PKEY_meth_set_verify$EVP_PKEY_meth_set_verify_recover$EVP_PKEY_meth_set_verifyctx$HMAC_CTX_cleanup$HMAC_CTX_init$HMAC_Final$HMAC_Init_ex$HMAC_Update$OBJ_nid2ln$OBJ_nid2obj$OBJ_nid2sn$OBJ_obj2nid
API String ID: 0-1034374683
Opcode ID: e357e797567c68f25c9f1189d0f6fa6853fb02746ce1290f92d42bc8afe56433
Instruction ID: 6ab945b67adb415c165fe7bb9e968181f211d730bd10a25d94f13f010a260aef
Opcode Fuzzy Hash: e357e797567c68f25c9f1189d0f6fa6853fb02746ce1290f92d42bc8afe56433
Instruction Fuzzy Hash: 84325271A14550DB6355EFBE988504B76E3EBC7300BC5C73BE014DB325EA3E489AAB12

Function 007A5746 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

fGz, xrefs: 007A5753

Memory Dump Source

Source File: 00000005.00000002.2480452888.00000000007A3000.00000020.00000001.01000000.00000008.sdmp, Offset: 007A3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7a3000_ComDebug.jbxd

Similarity

API ID:
String ID: fGz
API String ID: 0-3170053984
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Analysis Process: tapinstall.exePID: 6532, Parent PID: 3788COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.1%
Total number of Nodes:	214
Total number of Limit Nodes:	4

Executed Functions

Function 00007FF6CB9D41D0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF6CB9D42C8
GetLastError.KERNEL32 ref: 00007FF6CB9D42D2
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF6CB9D4300
CharNextW.USER32 ref: 00007FF6CB9D43C2
CharNextW.USER32 ref: 00007FF6CB9D43D6
SetupDiCreateDeviceInfoListExW.SETUPAPI ref: 00007FF6CB9D445C
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF6CB9D44A3
SetupDiOpenDeviceInfoW.SETUPAPI ref: 00007FF6CB9D44F9
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D4524
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF6CB9D455C
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6CB9D45C8
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF6CB9D4702

Part of subcall function 00007FF6CB9D4820: SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF6CB9D4624), ref: 00007FF6CB9D487F
Part of subcall function 00007FF6CB9D4820: GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6CB9D4624), ref: 00007FF6CB9D4894
Part of subcall function 00007FF6CB9D4820: SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF6CB9D4624), ref: 00007FF6CB9D4906

Part of subcall function 00007FF6CB9D50E0: CharNextW.USER32 ref: 00007FF6CB9D517A

Strings

p(+E, xrefs: 00007FF6CB9D41EF

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$Device$Info$CharListNext$ClassEnumErrorLastPropertyRegistry$CreateDestroyDetailDevice_DevsFromGet_GuidsNameOpen
String ID: p(+E
API String ID: 1969824741-992973349
Opcode ID: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
Instruction ID: 0bf825d49a2aeb0693a3a455b8f620dfaca070d1807cc46b927be118b4e62ade
Opcode Fuzzy Hash: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
Instruction Fuzzy Hash: 12E1A432B08AA286EB208F26F5403AA67A0FB49B99F544135DFCD97BA5DF3CD545C700

Function 00007FF6CB9D52E0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 230
shutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextW.USER32 ref: 00007FF6CB9D5339
CharNextW.USER32 ref: 00007FF6CB9D5482
GetCurrentProcess.KERNEL32 ref: 00007FF6CB9D55CD
OpenProcessToken.ADVAPI32 ref: 00007FF6CB9D55E0
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6CB9D55F8
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6CB9D5637
CloseHandle.KERNEL32 ref: 00007FF6CB9D5642
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF6CB9D5662

Strings

p(+E, xrefs: 00007FF6CB9D52F1
SeShutdownPrivilege, xrefs: 00007FF6CB9D55F1

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CharNextProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
String ID: SeShutdownPrivilege$p(+E
API String ID: 155161866-2849196290
Opcode ID: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
Instruction ID: 97a2d152c90ddc064c28c817522bfa42093ab358095fcdd3edb35a42334e1d6f
Opcode Fuzzy Hash: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
Instruction Fuzzy Hash: 3F91C221A0966286FB549F66F40537A6790FB8EB86F144035EECEC37B6DE3CE8458701

Function 00007FF6CB9D4820 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF6CB9D4624), ref: 00007FF6CB9D487F
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6CB9D4624), ref: 00007FF6CB9D4894
SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF6CB9D4624), ref: 00007FF6CB9D4906

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DevicePropertyRegistrySetup$ErrorLast
String ID:
API String ID: 2536536880-0
Opcode ID: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
Instruction ID: 5bb493000eee274cbc98fda0e7d12d55bf7580b6be6800b11156f66979675060
Opcode Fuzzy Hash: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
Instruction Fuzzy Hash: AB31772160875186EA64CF27B45426E62A0FF8EF91F884235DEDD87BA6EF3CD445CB40

Function 00007FF6CB9D789C Relevance: 9.1, APIs: 6, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__security_init_cookie.LIBCMT ref: 00007FF6CB9D78A0

Part of subcall function 00007FF6CB9D8414: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6CB9D8440
Part of subcall function 00007FF6CB9D8414: GetCurrentThreadId.KERNEL32 ref: 00007FF6CB9D844E
Part of subcall function 00007FF6CB9D8414: GetCurrentProcessId.KERNEL32 ref: 00007FF6CB9D845A
Part of subcall function 00007FF6CB9D8414: QueryPerformanceCounter.KERNEL32 ref: 00007FF6CB9D846A

Part of subcall function 00007FF6CB9D8124: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF6CB9D8146

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6CB9D78D9
__scrt_release_startup_lock.LIBCMT ref: 00007FF6CB9D7947
__scrt_is_managed_app.LIBCMT ref: 00007FF6CB9D79BE
__scrt_fastfail.LIBCMT ref: 00007FF6CB9D7A0C
__scrt_fastfail.LIBCMT ref: 00007FF6CB9D7A17

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CurrentTime__scrt_fastfail$CounterFilePerformanceProcessQuerySystemThread__scrt_acquire_startup_lock__scrt_is_managed_app__scrt_release_startup_lock__security_init_cookie__vcrt_initialize
String ID:
API String ID: 1566696921-0
Opcode ID: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
Instruction ID: 2d6ea274bd503df6ba5c19a1ff518b0aebbf68f1e67b54fd88257f65dc880b4f
Opcode Fuzzy Hash: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
Instruction Fuzzy Hash: CF415822E0C1A242FA54AFB6B4513F91290AF5E787F844434EACEC72F7DE2CE8458651

Function 00007FF6CBA1716C Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA171AD
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B,?,?,?,00007FF6CBA177D2), ref: 00007FF6CBA1726C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B,?,?,?,00007FF6CBA177D2), ref: 00007FF6CBA172EC

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
Instruction ID: 5a02691e9442dfeb4813db0ed332a42a1facdc0f043af02a2034c4cafb4f106b
Opcode Fuzzy Hash: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
Instruction Fuzzy Hash: 418191A2B18622C5F7919FE598402BC26A1FB6C78AF581136DECE936B5DF3CE445C310

Function 00007FF6CB9D28B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32 ref: 00007FF6CB9D2900
LoadStringW.USER32 ref: 00007FF6CB9D2920
LoadStringW.USER32 ref: 00007FF6CB9D2943

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D28BB

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: LoadString$FormatFreeLocalMessage
String ID: p(+E
API String ID: 725706356-992973349
Opcode ID: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
Instruction ID: 1d62a1e0b5fc0ce7903b83125870fa2fc5657e9690a6cd6cb5d0e59e0feec2b7
Opcode Fuzzy Hash: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
Instruction Fuzzy Hash: 4A416131B0869286E7758F62F4417AB72A4FB8D746F504035DACD93BA6DF2CE844CB01

Function 00007FF6CBA16CE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF6CBA16D93
GetLastError.KERNEL32 ref: 00007FF6CBA16DAF

Strings

p(+E, xrefs: 00007FF6CBA16CFB

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: p(+E
API String ID: 442123175-992973349
Opcode ID: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
Instruction ID: b627d121bddd6e4d8d0fed31995ce76053c8adcba76f686167185a123b321f8e
Opcode Fuzzy Hash: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
Instruction Fuzzy Hash: C631DF72A18A918AEB508F69E4442A977A0FB1C781F484032EACDC3734DF3CD451C700

Function 00007FF6CBA01608 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6CBA01607), ref: 00007FF6CBA01631
TerminateProcess.KERNEL32(?,?,?,00007FF6CBA01607), ref: 00007FF6CBA0163C
ExitProcess.KERNEL32 ref: 00007FF6CBA0164B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
Instruction ID: 4f90e94ca4334dee74a7a4ffccff224b0f688b9fa0db05a74f06d728a1dd7c08
Opcode Fuzzy Hash: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
Instruction Fuzzy Hash: 36E01260B4425186EA545FB27CA56B91252EF4C743F144538D5CF83376CE3DE4488301

Function 00007FF6CBA08634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08657

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF6CBA08650

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
Instruction ID: 9ba88ab33b68b694f84e39cdf8a2b29e97e8484a17c246f8ddbdb037b6fd7339
Opcode Fuzzy Hash: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
Instruction Fuzzy Hash: 55E04FA2E0555691FE098FD2A8451B01211DF5C772E490331DDFD8B3F09E3CEA958741

Function 00007FF6CBA09EA4 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6CBA09F1D
GetFileType.KERNELBASE ref: 00007FF6CBA09F33

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
Instruction ID: 5aada74405ee6516c785075054f182690a35b3f239459d691d01f902424f84b4
Opcode Fuzzy Hash: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
Instruction Fuzzy Hash: 4631DB31A18BA681D7648F9995901792650FB49BB1F64033AEBEF873F0CF38E465C345

Function 00007FF6CB9D4770 Relevance: 3.1, APIs: 2, Instructions: 51
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID:
API String ID: 1427518018-0
Opcode ID: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
Instruction ID: bbe5272b33e0eb90b216d72b12f16bb8e461559d324153a247614cc6b61c987f
Opcode Fuzzy Hash: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
Instruction Fuzzy Hash: 24118872B19B5485EB11CF22E84812E73A5FF89B81B558036CB9D83760EF3EC891C700

Function 00007FF6CB9D8124 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vcrt_initialize.LIBVCRUNTIME ref: 00007FF6CB9D8146

Part of subcall function 00007FF6CB9D9184: __vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00007FF6CB9D918D
Part of subcall function 00007FF6CB9D9184: __vcrt_initialize_locks.LIBVCRUNTIME ref: 00007FF6CB9D9192

__vcrt_uninitialize.LIBVCRUNTIME ref: 00007FF6CB9D815E

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: __vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
String ID:
API String ID: 1882725809-0
Opcode ID: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
Instruction ID: 93f1a1ed37c656e702cb7d9cc86afa8faaf5421abd38657e533ecbeb48229919
Opcode Fuzzy Hash: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
Instruction Fuzzy Hash: 89E0E550E0D17258FE582FB634821B916905F1F383F048579D8DDC31A38D0DB4496620

Function 00007FF6CBA17080 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
Instruction ID: cdc7cca60810be5f7bc4df2d39996b6f6955bf99e2f2e633e81fcd8591447fc7
Opcode Fuzzy Hash: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
Instruction Fuzzy Hash: 9E21D3A2E082A295E7415FE5A84137C2A50EF5C7A6F581136E9DE873F2CF7CE4418710

Function 00007FF6CBA0154C Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6CBA0156B

Part of subcall function 00007FF6CBA016E4: GetModuleHandleExW.KERNEL32 ref: 00007FF6CBA01700
Part of subcall function 00007FF6CBA016E4: GetProcAddress.KERNEL32 ref: 00007FF6CBA01716
Part of subcall function 00007FF6CBA016E4: FreeLibrary.KERNEL32 ref: 00007FF6CBA01733

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
Instruction ID: e29a8b3b823fe12e3b00bbbf21485875c8f16c3aba0be4f614ee8a0bcc61dae6
Opcode Fuzzy Hash: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
Instruction Fuzzy Hash: B0218032E047518AEF518FB4E4842EC36A0FB48709F444636E68F97BA5DF78D445CB80

Function 00007FF6CBA0CE60 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA0CE8B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
Instruction ID: 3f87c87665c04c4f28cae5b8b98c392fd6b0ace9ddc96222287585a673acb4bf
Opcode Fuzzy Hash: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
Instruction Fuzzy Hash: E1116D329086A2D2E3109F94B48017A72A4EB58742F590035E6DFD7AB2EF3CE8618744

Function 00007FF6CB9E6C8C Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9E6CAE

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
Instruction ID: 317c0af06a3aee4979fec0ac2cd620f09da2340286307a5edf59d5eed0600ffc
Opcode Fuzzy Hash: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
Instruction Fuzzy Hash: CEF03CB2A04B5198EB019FB0D8410EC37B4FB1839DF544A36EB9D42AA9EF38D555C290

Function 00007FF6CBA07978 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6CBA077C1,?,?,00000000,00007FF6CBA06B85,?,?,?,?,00007FF6CB9E6CA8), ref: 00007FF6CBA079CD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
Instruction ID: 2946684183d599d3f45ae1465ef3232f8145c431dbff4c0fe97f1709571ec967
Opcode Fuzzy Hash: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
Instruction Fuzzy Hash: 22F04F40B092A741FE955EE664512B92A84DFAC782F488431C9CFC72B1EE2CE8814211

Non-executed Functions

Function 00007FF6CB9D7030 Relevance: 42.3, APIs: 19, Strings: 5, Instructions: 255registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D7092
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D70B3
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF6CB9D70C8
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF6CB9D70E9
SetupDiOpenDevRegKey.SETUPAPI ref: 00007FF6CB9D711C
RegCloseKey.ADVAPI32 ref: 00007FF6CB9D7441

Strings

p(+E, xrefs: 00007FF6CB9D7050
ProviderName, xrefs: 00007FF6CB9D719A
DriverDesc, xrefs: 00007FF6CB9D722C
InfPath, xrefs: 00007FF6CB9D7151
InfSection, xrefs: 00007FF6CB9D71E3

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$DeviceDriverInfoInstallParams$BuildCloseEnumListOpen
String ID: DriverDesc$InfPath$InfSection$ProviderName$p(+E
API String ID: 1704563315-2598841820
Opcode ID: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
Instruction ID: d85632afac0e2bfee8d2212efe25f3f704b89c056eba1a28c9a66f4337174eac
Opcode Fuzzy Hash: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
Instruction Fuzzy Hash: ABB1A5726087A28AEB248F62F4443BA77A5FB99B8AF404135DECD83A64DF3CD505D700

Function 00007FF6CB9D6C90 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 208libraryfileloaderCOMMON

Download Yara Rule

APIs

SetupOpenInfFileW.SETUPAPI(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6CD1
GetLastError.KERNEL32(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6CE0
SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6D0C
SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6D32
SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6D89
SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6DB3
CLSIDFromString.OLE32(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6DC9
SetupDiGetClassDescriptionExW.SETUPAPI(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6DF2
LoadLibraryW.KERNEL32(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6E3A
GetProcAddress.KERNEL32(?,?,00000000,00000000,?,00007FF6CB9D3786), ref: 00007FF6CB9D6E5E
GetLastError.KERNEL32 ref: 00007FF6CB9D6EA1
GetLastError.KERNEL32 ref: 00007FF6CB9D6EAE
SetupFindFirstLineW.SETUPAPI ref: 00007FF6CB9D6F08

Strings

p(+E, xrefs: 00007FF6CB9D6CAD
ClassGUID, xrefs: 00007FF6CB9D6D7B
Provider, xrefs: 00007FF6CB9D6CFB
setupapi.dll, xrefs: 00007FF6CB9D6E33
Version, xrefs: 00007FF6CB9D6D05, 00007FF6CB9D6D82, 00007FF6CB9D6F01
SetupVerifyInfFile, xrefs: 00007FF6CB9D6E4C
DriverVer, xrefs: 00007FF6CB9D6EFA

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$ErrorFindFirstLastLineString$Field$AddressClassDescriptionFileFromLibraryLoadOpenProc
String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$p(+E$setupapi.dll
API String ID: 2815445529-3267909089
Opcode ID: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
Instruction ID: 5f777f98ace7735e251b34e9c40dd152ae23834538b971c39ce57fed338a2e8d
Opcode Fuzzy Hash: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
Instruction Fuzzy Hash: D8916D61A08AA285F710AFA2F8142FA2251FF89B82F504135D9CEC77F6DF3CE5458751

Function 00007FF6CB9D13E0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF6CB9D14AB
GetLastError.KERNEL32 ref: 00007FF6CB9D14B5
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF6CB9D150B
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF6CB9D17E0

Strings

p(+E, xrefs: 00007FF6CB9D1401
, xrefs: 00007FF6CB9D159D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$ClassFromGuidsName$DestroyDeviceErrorInfoLastList
String ID: $p(+E
API String ID: 1066883911-2365856657
Opcode ID: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
Instruction ID: 423bf2f65584efacf2fad5898902f102dfcaaec07a24fa26d73d74494f46269a
Opcode Fuzzy Hash: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
Instruction Fuzzy Hash: 5FB18372B0866286EB248F76F8402A963A1FB8ABA5F544235DE9D837F5DF3CD5058700

Function 00007FF6CBA1A070 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 368COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6CBA1A18A
memcpy_s.LIBCPMT ref: 00007FF6CBA1A258
memcpy_s.LIBCPMT ref: 00007FF6CBA1A27D
memcpy_s.LIBCPMT ref: 00007FF6CBA1A4FE
memcpy_s.LIBCPMT ref: 00007FF6CBA1A54A
memcpy_s.LIBCPMT ref: 00007FF6CBA1A579
memcpy_s.LIBCPMT ref: 00007FF6CBA1A60C

Strings

p(+E, xrefs: 00007FF6CBA1A08F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: memcpy_s
String ID: p(+E
API String ID: 1502251526-992973349
Opcode ID: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
Instruction ID: 8bbbb19529931e70daa6f8c49c7d1f48e448c0aec44ceb6e3fe7fbd7bb7db59f
Opcode Fuzzy Hash: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
Instruction Fuzzy Hash: B2E1D273A08292CAEB64CF55D408BED37A0FB4D789F449135DA9987B94DF39D901CB40

Function 00007FF6CBA0E0B0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 434COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA0E0E0

Part of subcall function 00007FF6CBA06A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6CBA069CD), ref: 00007FF6CBA06A29
Part of subcall function 00007FF6CBA06A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6CBA069CD), ref: 00007FF6CBA06A4E

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA0E305

Strings

p(+E, xrefs: 00007FF6CBA0E2DB, 00007FF6CBA0E9BB
*?, xrefs: 00007FF6CBA0E107

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo$CurrentFeaturePresentProcessProcessor
String ID: *?$p(+E
API String ID: 1697365638-235455522
Opcode ID: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
Instruction ID: 80636141a6c9ed184a512e9ca9028ed36b71c722e59b3cf70f3a3018496eee5e
Opcode Fuzzy Hash: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
Instruction Fuzzy Hash: E8F1E362F186E681EB10CFA6B8005AA67A0FB5CBD5F444536EEDE87BA4DF3CD4459300

Function 00007FF6CBA19BC0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 246COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6CBA19C17
memcpy_s.LIBCPMT ref: 00007FF6CBA19CDE
memcpy_s.LIBCPMT ref: 00007FF6CBA19D03
memcpy_s.LIBCPMT ref: 00007FF6CBA19F5F

Strings

p(+E, xrefs: 00007FF6CBA19BD4

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: memcpy_s
String ID: p(+E
API String ID: 1502251526-992973349
Opcode ID: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
Instruction ID: 4d0c387c210eb4ee2995fbdc68239b51434eb8d0be4ec03010a9e4d902b85801
Opcode Fuzzy Hash: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
Instruction Fuzzy Hash: BAA1D272A042D2CBD7B98F95E440AE97790FB68789F489135DBCA87B94CF38D941C704

Function 00007FF6CBA15478 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF6CBA027F1), ref: 00007FF6CBA155CF
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF6CBA155E8
ProcessCodePage.LIBCMT ref: 00007FF6CBA15612
IsValidCodePage.KERNEL32 ref: 00007FF6CBA15624
IsValidLocale.KERNEL32 ref: 00007FF6CBA1563A
GetLocaleInfoW.KERNEL32 ref: 00007FF6CBA15696
GetLocaleInfoW.KERNEL32 ref: 00007FF6CBA156B2

Strings

p(+E, xrefs: 00007FF6CBA1548A

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID: p(+E
API String ID: 3939093798-992973349
Opcode ID: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
Instruction ID: 9a9a605b1ca7f369a2074183425424e409cd966039e397d09e8ee911ebd9de91
Opcode Fuzzy Hash: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
Instruction Fuzzy Hash: 83719962B18662CAFB949FE5D4102BC27A1EF4C746F485036CADE976A5EF3CE844C740

Function 00007FF6CB9D4D80 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 43shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6CB9D239F), ref: 00007FF6CB9D4D93
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6CB9D239F), ref: 00007FF6CB9D4DA6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6CB9D4DBE
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6CB9D4DFD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6CB9D239F), ref: 00007FF6CB9D4E08
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF6CB9D4E28

Strings

p(+E, xrefs: 00007FF6CB9D4D84
SeShutdownPrivilege, xrefs: 00007FF6CB9D4DB7

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
String ID: SeShutdownPrivilege$p(+E
API String ID: 2036077386-2849196290
Opcode ID: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
Instruction ID: 48b8f20d5e94f93b6a83fe58a9501ed659402a1a7ae90ec4dfc5438d144060c6
Opcode Fuzzy Hash: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
Instruction Fuzzy Hash: 36112172A18B5296E754CF62F41966A77A0FB8D745F405035EACE83B64DF7CD144CB00

Function 00007FF6CBA14960 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

TranslateName.LIBCMT ref: 00007FF6CBA149CD
TranslateName.LIBCMT ref: 00007FF6CBA14A08
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF6CBA027F8), ref: 00007FF6CBA14A4D
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF6CBA027F8), ref: 00007FF6CBA14A75

Strings

p(+E, xrefs: 00007FF6CBA14BE7
utf8, xrefs: 00007FF6CBA14B59

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: p(+E$utf8
API String ID: 2136749100-4145348090
Opcode ID: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
Instruction ID: 06614517db31a7b255822fb0f03ecb2895c0006e06e41f98de441faf1f7e3dce
Opcode Fuzzy Hash: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
Instruction Fuzzy Hash: 06919532A08762C9EBA49FA6D4412B92754EF4CB86F488131DADEC77A5DF3CE551CB00

Function 00007FF6CBA06788 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6CBA06801
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6CBA06819
RtlVirtualUnwind.KERNEL32 ref: 00007FF6CBA06854
IsDebuggerPresent.KERNEL32 ref: 00007FF6CBA0688D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6CBA06897
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6CBA068A2

Strings

p(+E, xrefs: 00007FF6CBA067A5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: p(+E
API String ID: 1239891234-992973349
Opcode ID: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
Instruction ID: 2975bd0424c69b5d3050c54a571e99bac534a51b4788ac1ccf090f4b44525b76
Opcode Fuzzy Hash: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
Instruction Fuzzy Hash: BC316232608F9189D760CF66E8442AE73A4FB89759F540135EADD83BA9DF3CD145CB00

Function 00007FF6CBA166E8 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 321fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF6CBA16757
WriteFile.KERNEL32 ref: 00007FF6CBA16A01
WriteFile.KERNEL32 ref: 00007FF6CBA16A53
GetLastError.KERNEL32 ref: 00007FF6CBA16B95
GetLastError.KERNEL32 ref: 00007FF6CBA16BA7

Strings

p(+E, xrefs: 00007FF6CBA16704

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID: p(+E
API String ID: 786612050-992973349
Opcode ID: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
Instruction ID: 8a5268a3b9b7e2186ea890abcad9113b8913effb5fa5f7d3fc9c74ebc0262fb2
Opcode Fuzzy Hash: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
Instruction Fuzzy Hash: D5D10472B08AA19AE740CFA9D5441ED77B1FB49799B184135CECEC7BA9DE38D11AC300

Function 00007FF6CBA0ECAC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6CBA0ED6D
FindNextFileW.KERNEL32 ref: 00007FF6CBA0EDDB
FindClose.KERNEL32 ref: 00007FF6CBA0EE18

Strings

p(+E, xrefs: 00007FF6CBA0ECBF
., xrefs: 00007FF6CBA0EDAD
., xrefs: 00007FF6CBA0ED9E

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$.$p(+E
API String ID: 3541575487-3143858972
Opcode ID: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
Instruction ID: e81f1b37b513d401ad373b0b33a71fded44b4738e032d4c507e36e5694a12d2a
Opcode Fuzzy Hash: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
Instruction Fuzzy Hash: 20411962F185F144EA60DFE2B8042BAA391EB887E1F458131DECE876E4EE7CD4859300

Function 00007FF6CB9D3630 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 98fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF6CB9D3674
FindFirstFileW.KERNEL32 ref: 00007FF6CB9D371F

Strings

p(+E, xrefs: 00007FF6CB9D3639
\INF\OEM*.INF, xrefs: 00007FF6CB9D36D5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DirectoryFileFindFirstWindows
String ID: \INF\OEM*.INF$p(+E
API String ID: 1585389207-3662526370
Opcode ID: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
Instruction ID: 7720df796a02354d2759fbaa82aebf56e0df0ae3aff89ad8f90f994c1b6af1d6
Opcode Fuzzy Hash: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
Instruction Fuzzy Hash: D741A161B1C6A285EE609F22F4553BA62A0EF9AB52F944131C6CE837F6DF2CE405C300

Function 00007FF6CBA14ED0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

GetLocaleInfoW.KERNEL32 ref: 00007FF6CBA14F3C

Part of subcall function 00007FF6CB9E676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9E6789

GetLocaleInfoW.KERNEL32 ref: 00007FF6CBA14F85

Part of subcall function 00007FF6CB9E676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9E67E2

GetLocaleInfoW.KERNEL32 ref: 00007FF6CBA15050

Strings

p(+E, xrefs: 00007FF6CBA14EE5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
String ID: p(+E
API String ID: 3644580040-992973349
Opcode ID: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
Instruction ID: ef2cea387bd463a6e770404cf2e36dfdb458e1aeaa4ee1018a941fd3153d32e2
Opcode Fuzzy Hash: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
Instruction Fuzzy Hash: B761EF32A08652DAEBB48F91E5402BD73A5FB98742F089135CBDEC36A5DE3DE851C740

Function 00007FF6CBA08B44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08B7D
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF6CBA029CB), ref: 00007FF6CBA08BAB

Strings

GetLocaleInfoEx, xrefs: 00007FF6CBA08B60, 00007FF6CBA08B71

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
Instruction ID: cadaf0eff4bf8fbe744b7e760c0e4822580dc8755bacdeda0c9b617967ad94ee
Opcode Fuzzy Hash: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
Instruction Fuzzy Hash: 6001A264B08AA282E7048F96B4400A9B660EF9CBC2F544036EECD83B75CE3CD9018345

Function 00007FF6CBA0E810 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

p(+E, xrefs: 00007FF6CBA0E2DB, 00007FF6CBA0E9BB

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID:
String ID: p(+E
API String ID: 0-992973349
Opcode ID: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
Instruction ID: cef3e1580478a4ddaf7dd70a675cb8f4600846d8df45eb0b776248269a46c422
Opcode Fuzzy Hash: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
Instruction Fuzzy Hash: 4051B022F186A184F7209FB6A9401AE7BA4FB497D5F544235EEDE87AA5CF3CD001D700

Function 00007FF6CBA15120 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

GetLocaleInfoW.KERNEL32 ref: 00007FF6CBA15188

Strings

p(+E, xrefs: 00007FF6CBA15132

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: p(+E
API String ID: 3736152602-992973349
Opcode ID: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
Instruction ID: 82072993eef5e1fde7223ae500ce385040e55ba599e8dfe8e4d237053c8af2ed
Opcode Fuzzy Hash: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
Instruction Fuzzy Hash: C731C832A0869286EB649F61E4513BE7391FB5C742F449136DADDC7265DF3CE8048700

Function 00007FF6CBA07A70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6CBA08911,?,?,?,?,?,?,?,?,00000000,00007FF6CBA14244), ref: 00007FF6CBA07ABF

Strings

p(+E, xrefs: 00007FF6CBA07A93, 00007FF6CBA07AC7

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: EnumLocalesSystem
String ID: p(+E
API String ID: 2099609381-992973349
Opcode ID: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
Instruction ID: 0f9335e0eaad5d1f90997377a7e31b1ff3083fcd6714189ac9fc7016aca82e4b
Opcode Fuzzy Hash: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
Instruction Fuzzy Hash: C4F0F672A08A5182E744DFA6E8905AA3265EB9CB81F489136EACE93775DF3CD5508300

Function 00007FF6CBA07B7C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF6CBA07BB6

Strings

p(+E, xrefs: 00007FF6CBA07B80, 00007FF6CBA07BBC

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: EnumLocalesSystem
String ID: p(+E
API String ID: 2099609381-992973349
Opcode ID: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
Instruction ID: cb8b653aefc6ddd8f072b56e80faf3985ac5ef3dd009887568312b7a16c25abe
Opcode Fuzzy Hash: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
Instruction Fuzzy Hash: 98E06DA0A08A2185EB80DF81EC851253361EB6CBD1F405032D9CEC7334DF3CD1419300

Function 00007FF6CBA08BC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08BEB

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FF6CBA08BE4

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2742660187-595813830
Opcode ID: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
Instruction ID: b5fb756ab43700fcfcfc44ecf34df3f598a9de4135bc8a6631a42df276ee0123
Opcode Fuzzy Hash: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
Instruction Fuzzy Hash: 77E04691E1982B81FA198FE2A8151B02260EF1C746F480432CADC8B3B0DE3CAA85C709

Function 00007FF6CBA07BF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF6CBA07C2C

Strings

p(+E, xrefs: 00007FF6CBA07BFC, 00007FF6CBA07C32

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: EnumLocalesSystem
String ID: p(+E
API String ID: 2099609381-992973349
Opcode ID: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
Instruction ID: d6347f934adb22af6926465e2fcacc1999fae238ff4902a906ae656cbfe9521e
Opcode Fuzzy Hash: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
Instruction Fuzzy Hash: 7DE04F20E08A6285E2449FC1FC556753261EBED792F801136EDCE973309F3CD2559300

Function 00007FF6CBA14D3C Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6CBA1557B,?,00000000,00000092,?,?,00000000,?,00007FF6CBA027F1), ref: 00007FF6CBA14DDA

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
Instruction ID: 87d3268c4886e1349410e3afa6bda0fcd5cf07a1169fbe0083d5a887f84bf9e5
Opcode Fuzzy Hash: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
Instruction Fuzzy Hash: 9C11D563A18655CAFF548F59D0402A87BA1E794FE5F488135C6DA833E4CE78D5D1CB40

Function 00007FF6CBA1534C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

GetLocaleInfoW.KERNEL32(?,?,?,00007FF6CBA150CD), ref: 00007FF6CBA15383

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
Instruction ID: cbd56daf5bb0863bd342fedb65a1b4e928de2b731af1d0ab8ff2a0f08dbd1967
Opcode Fuzzy Hash: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
Instruction Fuzzy Hash: D9113A32A1C5A6C2E7A44F92D06027D22A0EB08765F582132EAFE836D4DE79DC818700

Function 00007FF6CBA14E0C Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6CBA15537,?,00000000,00000092,?,?,00000000,?,00007FF6CBA027F1), ref: 00007FF6CBA14E8A

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
Instruction ID: 7ec25da3cac6da1e14f60c89b5746f90bef004a65af341133a547780a8cecffe
Opcode Fuzzy Hash: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
Instruction Fuzzy Hash: 2C01F972F08191CAE7548F59E4407F97691EB54BA6F499231D2E9872E4CF38D580CB00

Function 00007FF6CBA14CB8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA075E8: GetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA075F7
Part of subcall function 00007FF6CBA075E8: SetLastError.KERNEL32(?,?,?,00007FF6CBA17232,?,?,?,?,?,?,?,?,?,?,?,00007FF6CBA1712B), ref: 00007FF6CBA07695

EnumSystemLocalesW.KERNEL32 ref: 00007FF6CBA14CFF

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
Instruction ID: 99b2226a0f9c618e701167f4340db9b8881f3b2492a4737dd7bdecd64c4dd1ca
Opcode Fuzzy Hash: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
Instruction Fuzzy Hash: 92F0E9A2B0879585EB404FA9F4403687BE1EB94BB4F098231D7FD832E5CE7CC4908700

Function 00007FF6CBA157E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6CBA157E4

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
Instruction ID: 69fcc95b8987f64132d3895a43d413ff31965825e80d4f51e06e139f035ae576
Opcode Fuzzy Hash: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
Instruction Fuzzy Hash: 42B09220E0BA12C6EA082F926C8621432A4FF9C702F944039C5CD83330DE2C20A55B12

Function 00007FF6CBA21B20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
Instruction ID: abd8f5aa971bfbd662c35fbecb6f8be43c660200b9480b1ff042cbb95ffac685
Opcode Fuzzy Hash: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
Instruction Fuzzy Hash: 10F06271B183E58ADBA48F69A84266977E0E74C381F908439D6CDC3B24DA3CD0608F08

Function 00007FF6CB9D8738 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
Instruction ID: cc2b92b126b0d5c1350355880fe13b58e3193a2ce721a334a98b73973feeefc4
Opcode Fuzzy Hash: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
Instruction Fuzzy Hash: E8A00161908862D4E6458F52B8981206361FB69302B400471D18D820B6DE2CA4008701

Function 00007FF6CB9DE890 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DE93C

Part of subcall function 00007FF6CB9DA83C: DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DA86E

DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DE94C

Part of subcall function 00007FF6CB9DAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DAD8B

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DEEBD
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DEEDE
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DEF26
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FF6CB9DEF3B
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DEF47
UnDecorator::getSymbolName.LIBVCRUNTIME ref: 00007FF6CB9DEF64
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DEF70
DName::operator+=.LIBCMT ref: 00007FF6CB9DEF80
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DE926

Part of subcall function 00007FF6CB9DAC18: DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DAC40

DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DE9C3
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DE9D3
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DE9E0
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DEA05
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DEA10
DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DEA8A
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DEA9B
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DEABF
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DEB65
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DEBA9
UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 00007FF6CB9DEBE8
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DEC67
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DEC88
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DECB5
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DECFA
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9DED03
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DED12
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DED1E
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9DED27
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DED36
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DED42
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9DED4B
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DED5A
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DED66
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DED80
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DED8C
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DED9B
UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FF6CB9DEDAB
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DEDBB
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DEDCB
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DEDDA
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DEDFC
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DEFD9

Strings

`anonymous namespace', xrefs: 00007FF6CB9DEC1D
`string', xrefs: 00007FF6CB9DEBDD
operator, xrefs: 00007FF6CB9DE931

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
String ID: `anonymous namespace'$`string'$operator
API String ID: 2020783597-815891235
Opcode ID: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
Instruction ID: fb18998397dc8cc6671b0588debda52b65a553d9639378a0836aa90d8c77e1ec
Opcode Fuzzy Hash: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
Instruction Fuzzy Hash: B8227172A18E7688FF14DF76E4902FC2761BB0A78AF944035DA8D976A6DE2CE455C300

Function 00007FF6CB9DC6CC Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DC75B
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DC818
UnDecorator::getECSUDataType.LIBVCRUNTIME ref: 00007FF6CB9DC8CC
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DC9CB
DName::operator+=.LIBCMT ref: 00007FF6CB9DC9DB
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DCA21
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DCA31
DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DCA65
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DCA75
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DCA82
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DCAB3
DName::operator+=.LIBCMT ref: 00007FF6CB9DCAC7
DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DCADD
UnDecorator::getPtrRefType.LIBVCRUNTIME ref: 00007FF6CB9DCAF4
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DCB14

Strings

char32_t, xrefs: 00007FF6CB9DC90A
__int32, xrefs: 00007FF6CB9DC881
UNKNOWN, xrefs: 00007FF6CB9DC8F2
volatile, xrefs: 00007FF6CB9DCAD2
double, xrefs: 00007FF6CB9DC9D0
__w64 , xrefs: 00007FF6CB9DC80A
char16_t, xrefs: 00007FF6CB9DC916
<unknown>, xrefs: 00007FF6CB9DC922
signed , xrefs: 00007FF6CB9DCA16
__int64, xrefs: 00007FF6CB9DC875
void, xrefs: 00007FF6CB9DC99D
__int8, xrefs: 00007FF6CB9DC7F5
wchar_t, xrefs: 00007FF6CB9DC8FE
__int16, xrefs: 00007FF6CB9DC84A
bool, xrefs: 00007FF6CB9DC88D
float, xrefs: 00007FF6CB9DC750
char, xrefs: 00007FF6CB9DC780
volatile, xrefs: 00007FF6CB9DCABC
long , xrefs: 00007FF6CB9DC9C0
const, xrefs: 00007FF6CB9DCAA8
__int128, xrefs: 00007FF6CB9DC869
short, xrefs: 00007FF6CB9DC777
long, xrefs: 00007FF6CB9DC765
int, xrefs: 00007FF6CB9DC76E
unsigned , xrefs: 00007FF6CB9DCA0D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 1480303775-3737837666
Opcode ID: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
Instruction ID: fc15c5ed85e92ee95441f7a92e05b67e3b4a1b8cb06b056c63ff492edc5dd32f
Opcode Fuzzy Hash: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
Instruction Fuzzy Hash: 80D13B61E1862294FB14CFB6E8842BC2270BB1E756F904532DA8DD76B6EF7CE944C341

Function 00007FF6CB9E03F0 Relevance: 61.5, APIs: 30, Strings: 5, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FF6CB9E0470

Part of subcall function 00007FF6CB9DD694: UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FF6CB9DD6DC

UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E047E
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E0487
DName::getString.LIBVCRUNTIME ref: 00007FF6CB9E04AE
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9E04DE
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9E04ED
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9E04FC
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9E0520
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E0551
DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9E0594
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FF6CB9E05A5
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E05B1
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E05BC
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E05DE
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E05EA
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E05F5
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E05FE
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E060A
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E0615
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E061E
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E062A
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9E0639

Strings

p(+E, xrefs: 00007FF6CB9E040B
NULL, xrefs: 00007FF6CB9E0516
`template-type-parameter-, xrefs: 00007FF6CB9E0770
`generic-method-parameter-, xrefs: 00007FF6CB9E0732
`generic-class-parameter-, xrefs: 00007FF6CB9E0767

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$p(+E
API String ID: 283215372-4209355209
Opcode ID: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
Instruction ID: 2155fbeb32853968fe6c5baa6706fb7710d819e8ebe2eda76f3460c4ae3f79fd
Opcode Fuzzy Hash: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
Instruction Fuzzy Hash: 58B17E22F0C6A298FB109F75D4462FC2365AB5A746F940036CA8D976B7DF3CE50AC390

Function 00007FF6CB9DE070 Relevance: 52.9, APIs: 35, Instructions: 365COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DE0C1

Part of subcall function 00007FF6CB9DAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DAD8B

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DE179
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DE189
UnDecorator::getScope.LIBVCRUNTIME ref: 00007FF6CB9DE1AC
DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DE1CE
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DE1DE
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DE1EF
UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 00007FF6CB9DE296

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
String ID:
API String ID: 3173522582-0
Opcode ID: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
Instruction ID: f40beb856c1e94d4a0eadb59efca79edd831b4a1ccc35ebda8e73e652a44243c
Opcode Fuzzy Hash: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
Instruction Fuzzy Hash: EA028076B08AA29AEB11DF76E4401FC37B0EB0974DB444035DA8D97BAADF38D515C350

Function 00007FF6CBA092EC Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09307
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09326

Part of subcall function 00007FF6CBA081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA08300

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09345

Part of subcall function 00007FF6CBA081A8: LoadLibraryExW.KERNELBASE(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA0824B
Part of subcall function 00007FF6CBA081A8: GetLastError.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA08259
Part of subcall function 00007FF6CBA081A8: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA0829B

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09364

Part of subcall function 00007FF6CBA081A8: FreeLibrary.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA082D4

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09383
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA093A2
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA093C1
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA093E0
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA093FF
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA0941E

Strings

LocaleNameToLCID, xrefs: 00007FF6CBA09423, 00007FF6CBA09436
AreFileApisANSI, xrefs: 00007FF6CBA09300
IsValidLocaleName, xrefs: 00007FF6CBA093C6, 00007FF6CBA093D9
GetLocaleInfoEx, xrefs: 00007FF6CBA09369, 00007FF6CBA0937C
LCIDToLocaleName, xrefs: 00007FF6CBA09404, 00007FF6CBA09417
CompareStringEx, xrefs: 00007FF6CBA0930C, 00007FF6CBA0931F
GetTimeFormatEx, xrefs: 00007FF6CBA09388, 00007FF6CBA0939B
GetUserDefaultLocaleName, xrefs: 00007FF6CBA093A7, 00007FF6CBA093BA
EnumSystemLocalesEx, xrefs: 00007FF6CBA0932B, 00007FF6CBA0933E
LCMapStringEx, xrefs: 00007FF6CBA093E5, 00007FF6CBA093F8
GetDateFormatEx, xrefs: 00007FF6CBA0934A, 00007FF6CBA0935D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
Instruction ID: 0351545ed95466312ba7ee6965b18fb6b8226d6a5eaecc79401d15d98cd6fae3
Opcode Fuzzy Hash: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
Instruction Fuzzy Hash: 26314064909A67A1FA04DFE6EC595F02321EF68306F805433D4CE972B58E3CAB4AC742

Function 00007FF6CB9D61F0 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 191COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D6237
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF6CB9D6260
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF6CB9D6289
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF6CB9D62AA
CM_Get_First_Log_Conf_Ex.SETUPAPI ref: 00007FF6CB9D62D8
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF6CB9D638E
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF6CB9D63A8
CM_Get_Res_Des_Data_Size_Ex.SETUPAPI ref: 00007FF6CB9D63C1
CM_Get_Res_Des_Data_Ex.SETUPAPI ref: 00007FF6CB9D63F9
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF6CB9D64C6
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF6CB9D64EC
CM_Free_Log_Conf_Handle.SETUPAPI ref: 00007FF6CB9D64F7

Strings

IRQ : %u, xrefs: 00007FF6CB9D642E
p(+E, xrefs: 00007FF6CB9D6204
MEM : %08I64x-%08I64x, xrefs: 00007FF6CB9D6490
DMA : %u, xrefs: 00007FF6CB9D6449
IO : %04I64x-%04I64x, xrefs: 00007FF6CB9D646F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Get_$Des_Res_$Conf_Log_$First_Free_Handle$Data_Next_$DetailDeviceInfoListNode_SetupSize_Status_
String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x$p(+E
API String ID: 2957808706-2400173381
Opcode ID: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
Instruction ID: 1f0eb4fbfa6596f3abb5e408892c6c4835a1d16d744552f86128e538b713d288
Opcode Fuzzy Hash: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
Instruction Fuzzy Hash: 119175726186A286E750CF66F45467A7764FB8AB85F440035EACD87BBADF3CE444CB00

Function 00007FF6CB9D2C90 Relevance: 28.4, APIs: 11, Strings: 5, Instructions: 380serviceregistryCOMMON

Download Yara Rule

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF6CB9D2D04
GetLastError.KERNEL32 ref: 00007FF6CB9D2D0E

Part of subcall function 00007FF6CB9E676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9E6789

SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF6CB9D2D96
OpenSCManagerW.ADVAPI32 ref: 00007FF6CB9D2ED7
OpenServiceW.ADVAPI32 ref: 00007FF6CB9D2EF5
CloseServiceHandle.ADVAPI32 ref: 00007FF6CB9D2F06
CloseServiceHandle.ADVAPI32 ref: 00007FF6CB9D2F0F
RegCloseKey.ADVAPI32 ref: 00007FF6CB9D31FD
RegCloseKey.ADVAPI32 ref: 00007FF6CB9D321B

Strings

lower, xrefs: 00007FF6CB9D2D50
p(+E, xrefs: 00007FF6CB9D2CA1
upper, xrefs: 00007FF6CB9D2D2B
LowerFilters, xrefs: 00007FF6CB9D2D64
UpperFilters, xrefs: 00007FF6CB9D2D43

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Close$OpenService$ClassHandleSetup$ErrorFromGuidsLastManagerName_invalid_parameter_noinfo
String ID: LowerFilters$UpperFilters$lower$p(+E$upper
API String ID: 159866419-1668113848
Opcode ID: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
Instruction ID: 8b2871dc19f837f47e6e8079a5d79a59c1fcc3dca90b3f4523575ba988019d25
Opcode Fuzzy Hash: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
Instruction Fuzzy Hash: 6AE1D022A0D66281EA649F27F54037A72A1FF4ABD2F448135DE9E877F6DE3CE4458340

Function 00007FF6CB9E1088 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIME ref: 00007FF6CB9E1108
Replicator::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E132B

Strings

template-parameter-, xrefs: 00007FF6CB9E1165
p(+E, xrefs: 00007FF6CB9E10A7
generic-type-, xrefs: 00007FF6CB9E11A1

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Decorator::getNameReplicator::operator+=Template
String ID: generic-type-$p(+E$template-parameter-
API String ID: 2731555906-3216009471
Opcode ID: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
Instruction ID: 55540c14d6c3eba405b87876538aa3f2b9102b272bbcc2e8bbbad42442ed0e9d
Opcode Fuzzy Hash: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
Instruction Fuzzy Hash: 87919F62B18AA689EB148FA5D8501BC37B1FB4AB86B804035DACDC77B6DF3CE405C340

Function 00007FF6CB9D5BD0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 272timeCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D5C48
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D5C69
SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF6CB9D5C81
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF6CB9D5CB3
SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF6CB9D5D2A
GetLastError.KERNEL32 ref: 00007FF6CB9D5D34
FileTimeToSystemTime.KERNEL32 ref: 00007FF6CB9D5E13
GetDateFormatW.KERNEL32 ref: 00007FF6CB9D5E42
SetupDiGetDriverInstallParamsW.SETUPAPI ref: 00007FF6CB9D5EDC
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF6CB9D602B
SetupDiDestroyDriverInfoList.SETUPAPI ref: 00007FF6CB9D6061

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D5BEC
, xrefs: 00007FF6CB9D5EC7

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$Driver$Info$InstallParams$DeviceEnumFormatListTime$BuildDateDestroyDetailErrorFileFreeLastLocalMessageSystem
String ID: $p(+E
API String ID: 2668181066-2365856657
Opcode ID: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
Instruction ID: 2f10f0d7b4c54ab1becee1db62beb3e47027dffd6d0c78141f4265177b15028f
Opcode Fuzzy Hash: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
Instruction Fuzzy Hash: C4C19435A081A14AF314AF72E4157FA7291FF8A785F404435EA8E8B7E7CE3DE9408791

Function 00007FF6CB9E3800 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 316COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6CB9E3865

Part of subcall function 00007FF6CB9E5DD8: __GetUnwindTryBlock.LIBCMT ref: 00007FF6CB9E5E1B
Part of subcall function 00007FF6CB9E5DD8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6CB9E5E40

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6CB9E393D
TypeMatchHelper.LIBVCRUNTIME ref: 00007FF6CB9E3AAC
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6CB9E3BB2
__FrameHandler3::UnwindNestedFrames.LIBVCRUNTIME ref: 00007FF6CB9E3C41
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E3CB6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CB9E3CBF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6CB9E3CCF

Strings

csm, xrefs: 00007FF6CB9E38E6
p(+E, xrefs: 00007FF6CB9E3819
csm, xrefs: 00007FF6CB9E3960
csm, xrefs: 00007FF6CB9E387F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FrameHandler3::Unwind$BlockException$CatchDestructExecutionFramesHandlerHelperIs_bad_exception_allowedMatchNestedObjectSearchStateThrowTypestd::bad_alloc::bad_alloc
String ID: csm$csm$csm$p(+E
API String ID: 15165021-242686763
Opcode ID: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
Instruction ID: 8190f1b3dfdf58efb3e0f08c97ae90cfc5c52bab6ab4af46baab1108c78346a4
Opcode Fuzzy Hash: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
Instruction Fuzzy Hash: 17E17D32A0C7918AEB619F65D4403AE77A0FB4A799F140235EECD97B66DF38E490C740

Function 00007FF6CB9D5920 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CB9D7030: SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D7092
Part of subcall function 00007FF6CB9D7030: SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D70B3
Part of subcall function 00007FF6CB9D7030: SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF6CB9D70C8
Part of subcall function 00007FF6CB9D7030: SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF6CB9D70E9

SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF6CB9D59DC
GetLastError.KERNEL32 ref: 00007FF6CB9D59E6
SetupDiSetSelectedDriverW.SETUPAPI ref: 00007FF6CB9D5A1E
SetupOpenFileQueue.SETUPAPI ref: 00007FF6CB9D5A2C
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D5A64
SetupDiSetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D5A87
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF6CB9D5AA0
SetupScanFileQueueW.SETUPAPI ref: 00007FF6CB9D5AE5
SetupScanFileQueueW.SETUPAPI ref: 00007FF6CB9D5B4D
SetupDiDestroyDriverInfoList.SETUPAPI ref: 00007FF6CB9D5B6D
SetupCloseFileQueue.SETUPAPI ref: 00007FF6CB9D5B7C

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D5937

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$Driver$DeviceFileInfoInstallParamsQueue$ListScan$BuildCallClassCloseDestroyDetailEnumErrorFormatFreeInstallerLastLocalMessageOpenSelected
String ID: p(+E
API String ID: 1606212837-992973349
Opcode ID: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
Instruction ID: f35813b2572d261d410f661830c6eb7303a3e933baebb5885f61e4b2234c5089
Opcode Fuzzy Hash: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
Instruction Fuzzy Hash: C461C3316186A28AE720DF72E8543FA33A5FB49B95F404235DA9D87BE6DF3CE5058700

Function 00007FF6CB9D6530 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 116COMMON

Download Yara Rule

APIs

CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF6CB9D6573
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF6CB9D658E
CM_Get_Res_Des_Data_Size_Ex.SETUPAPI ref: 00007FF6CB9D65AA
CM_Get_Res_Des_Data_Ex.SETUPAPI ref: 00007FF6CB9D65E8
CM_Get_Next_Res_Des_Ex.SETUPAPI ref: 00007FF6CB9D66C0
CM_Free_Res_Des_Handle.SETUPAPI ref: 00007FF6CB9D66DB

Strings

IRQ : %u, xrefs: 00007FF6CB9D6620
MEM : %08I64x-%08I64x, xrefs: 00007FF6CB9D6682
DMA : %u, xrefs: 00007FF6CB9D663B
IO : %04I64x-%04I64x, xrefs: 00007FF6CB9D6661

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Des_Res_$Get_$Data_Free_HandleNext_$Size_
String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
API String ID: 1110773400-3427375868
Opcode ID: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
Instruction ID: 5db1f9559686b802b332bc7fb00853e2d53725b0ef77ee52596650ec6f0c778b
Opcode Fuzzy Hash: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
Instruction Fuzzy Hash: 72419F72A0866286E7609F3AF55867A6360FB8AB85F444035DECD877B6DE3CE400CB00

Function 00007FF6CB9D34B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6CB9D350F
LoadLibraryW.KERNEL32 ref: 00007FF6CB9D3530
GetProcAddress.KERNEL32 ref: 00007FF6CB9D354C
GetLastError.KERNEL32 ref: 00007FF6CB9D3572
FreeLibrary.KERNEL32 ref: 00007FF6CB9D35B5

Strings

p(+E, xrefs: 00007FF6CB9D34BD
SetupUninstallOEMInfW, xrefs: 00007FF6CB9D3542
setupapi.dll, xrefs: 00007FF6CB9D3529

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
String ID: SetupUninstallOEMInfW$p(+E$setupapi.dll
API String ID: 3805412813-1584380536
Opcode ID: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
Instruction ID: aac8ca8f525b01f6d86d69cc868c4162ec8a1521be3493212fa039001a884d0c
Opcode Fuzzy Hash: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
Instruction Fuzzy Hash: 4D316F21A0C6A686FB649F62F85937A6291EF8D746F400035DACEC77B6CF3CE8448741

Function 00007FF6CB9E3CDC Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6CB9E3E8B
TypeMatchHelper.LIBVCRUNTIME ref: 00007FF6CB9E3FE3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E41C2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CB9E41CB
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6CB9E41DB

Strings

p(+E, xrefs: 00007FF6CB9E3CF8
csm, xrefs: 00007FF6CB9E3E34
csm, xrefs: 00007FF6CB9E3EB2
csm, xrefs: 00007FF6CB9E3DCD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Exception$DestructHelperIs_bad_exception_allowedMatchObjectThrowTypestd::bad_alloc::bad_alloc
String ID: csm$csm$csm$p(+E
API String ID: 3999431683-242686763
Opcode ID: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
Instruction ID: fdeaeb5ce3d57f4d1e3f11baed0aab29d5a90d46fc09a8271657876580c13587
Opcode Fuzzy Hash: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
Instruction Fuzzy Hash: F9E1A072A087A28AEB11DF35D4413AD3BA0FB5A74AF114235EACD87766CF38E585C740

Function 00007FF6CB9D2540 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6CB9D25BE
SetupDiGetINFClassW.SETUPAPI ref: 00007FF6CB9D2668
SetupDiCreateDeviceInfoList.SETUPAPI ref: 00007FF6CB9D267D
SetupDiCreateDeviceInfoW.SETUPAPI ref: 00007FF6CB9D26BF
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF6CB9D270D
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF6CB9D2724
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF6CB9D2762

Strings

p(+E, xrefs: 00007FF6CB9D255B
, xrefs: 00007FF6CB9D2695

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$Device$Info$ClassCreateList$CallDestroyFullInstallerNamePathPropertyRegistry
String ID: $p(+E
API String ID: 1846165353-2365856657
Opcode ID: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
Instruction ID: 13fdcda2428f2e676163d5c7934c195a8a0ca655259084c5726e7d21593ad978
Opcode Fuzzy Hash: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
Instruction Fuzzy Hash: EE518036708B9182EB208F22F4147AA73A1FB89B91F944231DADD837A5DF3CE545CB01

Function 00007FF6CB9E07B4 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9E07F9
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FF6CB9E0810
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9E0887

Part of subcall function 00007FF6CB9DA83C: DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DA86E

DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9E0897

Part of subcall function 00007FF6CB9DAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DAD8B

DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9E08AA

Part of subcall function 00007FF6CB9DADF4: DName::operator+=.LIBCMT ref: 00007FF6CB9DAE0F

Strings

p(+E, xrefs: 00007FF6CB9E07C6
`template-parameter, xrefs: 00007FF6CB9E087C
void, xrefs: 00007FF6CB9E07E8

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
String ID: `template-parameter$p(+E$void
API String ID: 1951524168-1759330846
Opcode ID: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
Instruction ID: 205a8f363d6443a07459e2d911b5157abbae7f0b863328e74dcb5ca8a6455778
Opcode Fuzzy Hash: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
Instruction Fuzzy Hash: A2313F21F18A6289FB058FA5D8553BD2365BB4DB86F940035CE8D97676DF3CE405C380

Function 00007FF6CBA15BA8 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA15C79
SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF6CBA04768), ref: 00007FF6CBA15E81
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF6CBA04768), ref: 00007FF6CBA15E9C

Strings

p(+E, xrefs: 00007FF6CBA15C8E
p(+E, xrefs: 00007FF6CBA15CCE, 00007FF6CBA15D77, 00007FF6CBA15EB2
p(+E, xrefs: 00007FF6CBA15CA9
p(+E, xrefs: 00007FF6CBA15CA0
p(+E, xrefs: 00007FF6CBA15C97

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast_invalid_parameter_noinfo
String ID: p(+E$p(+E$p(+E$p(+E$p(+E
API String ID: 2654339681-2102478280
Opcode ID: 6d969c5baca6aee0a9350a4ede2d8e1bfd7b8c06fbf4ba98dec923d8230d5f12
Instruction ID: d49cd1875eff09fc00a6b7f1f7d86ee6b2a23062caf4861fdb7cd341d4a42a25
Opcode Fuzzy Hash: 6d969c5baca6aee0a9350a4ede2d8e1bfd7b8c06fbf4ba98dec923d8230d5f12
Instruction Fuzzy Hash: F4C18C32E09662C6FAA49FD990542796691EF8D782F586436DACE873F1DF3CEC448300

Function 00007FF6CB9D23C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6CB9D242C
GetFileAttributesW.KERNEL32 ref: 00007FF6CB9D2444
LoadLibraryW.KERNEL32 ref: 00007FF6CB9D2462
GetProcAddress.KERNEL32 ref: 00007FF6CB9D2486
FreeLibrary.KERNEL32 ref: 00007FF6CB9D24F7

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

newdev.dll, xrefs: 00007FF6CB9D2453
p(+E, xrefs: 00007FF6CB9D23CD
UpdateDriverForPlugAndPlayDevicesW, xrefs: 00007FF6CB9D2474

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FreeLibrary$AddressAttributesFileFormatFullLoadLocalMessageNamePathProc
String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll$p(+E
API String ID: 3199543795-3347686165
Opcode ID: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
Instruction ID: 25490a016100ecd820618e40d92d2f2b40b69fd2d6ea328df903609119d2bf65
Opcode Fuzzy Hash: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
Instruction Fuzzy Hash: 93315221A0C69285EB549F62F4987A97360FB8DB41F444035DBCD837A6DF3CE449C701

Function 00007FF6CB9D6700 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156registryCOMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D672F
SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF6CB9D676F
RegCloseKey.ADVAPI32 ref: 00007FF6CB9D690B

Part of subcall function 00007FF6CB9D4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF6CB9D4C83
Part of subcall function 00007FF6CB9D4C30: GetLastError.KERNEL32 ref: 00007FF6CB9D4C94
Part of subcall function 00007FF6CB9D4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF6CB9D4CF6

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D670A
%s, xrefs: 00007FF6CB9D6873
LowerFilters, xrefs: 00007FF6CB9D68B5
UpperFilters, xrefs: 00007FF6CB9D677E

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: QuerySetupValue$ClassCloseDetailDeviceErrorFormatFreeInfoLastListLocalMessageOpen
String ID: %s$LowerFilters$UpperFilters$p(+E
API String ID: 1933970874-2421688173
Opcode ID: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
Instruction ID: ac92d880ddd236208862725d743608513bc3a0998033bbb469f9f8921d421496
Opcode Fuzzy Hash: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
Instruction Fuzzy Hash: 63516221B0C2A645FA146F73F4163BA52819F8EB92F484134D9CE8B7F7DE6CE8414791

Function 00007FF6CB9D1160 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

SetupDiBuildClassInfoListExW.SETUPAPI ref: 00007FF6CB9D11D0
GetLastError.KERNEL32 ref: 00007FF6CB9D11E0
SetupDiBuildClassInfoListExW.SETUPAPI ref: 00007FF6CB9D1232
SetupDiClassNameFromGuidExW.SETUPAPI ref: 00007FF6CB9D1294
SetupDiGetClassDescriptionExW.SETUPAPI ref: 00007FF6CB9D1314

Strings

p(+E, xrefs: 00007FF6CB9D116C
%-20s: %s, xrefs: 00007FF6CB9D1380

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ClassSetup$BuildInfoList$DescriptionErrorFromGuidLastName
String ID: %-20s: %s$p(+E
API String ID: 3437477559-901456425
Opcode ID: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
Instruction ID: 9f0a2ef61198cbf95897543209270620430c2683227747fb13569ea27d76af8e
Opcode Fuzzy Hash: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
Instruction Fuzzy Hash: 6A5184627186A286EA608F62F4547BE73B0FB89B81F844135DACD87BA5DF3CD505C700

Function 00007FF6CB9DD948 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DD9B5
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DD9C4
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DD9D3
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DD9E6

Part of subcall function 00007FF6CB9DA960: DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DA9CD

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DDA62
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DDA70

Strings

`non-type-template-parameter, xrefs: 00007FF6CB9DD97B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: NameName::$Name::doName::operator+Pchar
String ID: `non-type-template-parameter
API String ID: 3026640183-4247534891
Opcode ID: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
Instruction ID: 7f0953abee97d89268592aa7663effd28c9155871f3b041a025ac92ebf7c83d5
Opcode Fuzzy Hash: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
Instruction Fuzzy Hash: D0416E32A0D6B295E710CF62E4801BC73A4FF1AB82B958035DACD976B6DF28E815C300

Function 00007FF6CB9D3A00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D3A33
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6CB9D3A5F
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF6CB9D3AA1
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF6CB9D3AB6
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D3AD9

Strings

p(+E, xrefs: 00007FF6CB9D3A0B
%-60s: %s, xrefs: 00007FF6CB9D3B13

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerList
String ID: %-60s: %s$p(+E
API String ID: 4184553637-3704827851
Opcode ID: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
Instruction ID: aa2aaea56b500ce41e6ba594d7ad7254cebe360d4f51cda3bda7e27370491c48
Opcode Fuzzy Hash: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
Instruction Fuzzy Hash: 5B3175B160C69286FB608F62F9487AB7760FB49B86F404135CA8D87AA5DF3CD445CB00

Function 00007FF6CB9DC60C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DC631
UnDecorator::getScopedName.LIBVCRUNTIME ref: 00007FF6CB9DC66C

Part of subcall function 00007FF6CB9DFB2C: UnDecorator::getScope.LIBVCRUNTIME ref: 00007FF6CB9DFB72
Part of subcall function 00007FF6CB9DFB2C: DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DFB86
Part of subcall function 00007FF6CB9DFB2C: DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DFB96

DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DC679

Part of subcall function 00007FF6CB9DAE4C: DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DAE67

DName::operator+=.LIBCMT ref: 00007FF6CB9DC6AE

Part of subcall function 00007FF6CB9DAFA8: DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DAFD3

Strings

void, xrefs: 00007FF6CB9DC680

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Name::operator+=$Decorator::getNameName::operator+$Name::Name::operator=ScopeScoped
String ID: void
API String ID: 3176039966-3531332078
Opcode ID: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
Instruction ID: 05daf96375c39f4aa3972851690bc6a920a89606ca08373800e382f106fcf308
Opcode Fuzzy Hash: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
Instruction Fuzzy Hash: 10118E62A1C65285EB208F36F4542B96760FF9E746F845031D6CDC72BADE2CE505C701

Function 00007FF6CBA1EE2C Relevance: 10.8, APIs: 7, Instructions: 291COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA1F262

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
Instruction ID: 415d356299d8e116682f09f5a723c50eaf9c442e1dc16603d36ffabc4072a905
Opcode Fuzzy Hash: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
Instruction Fuzzy Hash: D0C10522A0C6E691EAA09F95E4442BD7B64FB4DB86F484131DACE837B1DF7EE455C300

Function 00007FF6CB9D3B40 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D3B8A
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6CB9D3BB9
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF6CB9D3BE1
SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF6CB9D3E64

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D3B4D
%-60s: , xrefs: 00007FF6CB9D3BFA, 00007FF6CB9D3EDD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DeviceGet_Setup$DetailDevice_FormatFreeInfoListLocalMessageNode_PropertyRegistryStatus_
String ID: %-60s: $p(+E
API String ID: 1934003045-3513633485
Opcode ID: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
Instruction ID: c7ebe4eb6e6ff4328ca49bc63ac4109a367af5283061ca4b939584cfe2f947c2
Opcode Fuzzy Hash: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
Instruction Fuzzy Hash: 3AB1C431A0CAA681EA209F27F44427A67A4FB5AB86F444135DEDE877E6DF3CE451C700

Function 00007FF6CB9DDD94 Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DDE35
DName::DName.LIBVCRUNTIME ref: 00007FF6CB9DDE40

Part of subcall function 00007FF6CB9DA960: DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DA9CD

DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DDE50

Part of subcall function 00007FF6CB9DAD70: DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DAD8B

DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DDE6D
DName::operator+.LIBVCRUNTIME ref: 00007FF6CB9DDEA2

Part of subcall function 00007FF6CB9DAD9C: DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DADB7

DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DDED5

Part of subcall function 00007FF6CB9DB034: DName::append.LIBVCRUNTIME ref: 00007FF6CB9DB078

DName::doPchar.LIBVCRUNTIME ref: 00007FF6CB9DDF34

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
String ID:
API String ID: 3659116837-0
Opcode ID: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
Instruction ID: e9c3466054d473f61d0d6b6e53014489397c513f57d68611414c289cab0388c3
Opcode Fuzzy Hash: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
Instruction Fuzzy Hash: B7612D32A18A6289E715CF75E8803AC3BA1FB5974AF548035DA8D877B6EF3DD545C300

Function 00007FF6CB9FF964 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF6CB9FF984
GetModuleFileNameW.KERNEL32 ref: 00007FF6CB9FF9E5

Strings

<program name unknown>, xrefs: 00007FF6CB9FF9F3
Microsoft Visual C++ Runtime Library, xrefs: 00007FF6CB9FFA7A
..., xrefs: 00007FF6CB9FFA3C
Runtime Error!Program: , xrefs: 00007FF6CB9FF9B5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FileModuleName_set_error_mode
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3581924421-4022980321
Opcode ID: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
Instruction ID: 99fe24ee924aa8c15d5ba322495036e0e7c04a2ddb0292da99500850277dc950
Opcode Fuzzy Hash: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
Instruction Fuzzy Hash: AE41D725B0976681FE149F62A4042B66354EF5DBE6F404531EEDEC77B6EE3CE1058700

Function 00007FF6CB9D37D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF6CB9D3834
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF6CB9D3849
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF6CB9D3880
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF6CB9D3895
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF6CB9D38B2

Part of subcall function 00007FF6CB9D6B80: SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D6BB9
Part of subcall function 00007FF6CB9D6B80: CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6CB9D6BE3

Strings

p(+E, xrefs: 00007FF6CB9D37DB

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Setup$Class$InstallParams$CallDeviceInstaller$DetailDevice_Get_InfoList
String ID: p(+E
API String ID: 3081971210-992973349
Opcode ID: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
Instruction ID: 806a69a11cda53599a11e4c43d6434d0bb536ec6f643a8504a6f2b7197df942e
Opcode Fuzzy Hash: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
Instruction Fuzzy Hash: CF311AB1A0C25586F7208F62A5593BA67A1FB4AFCAF004135DECD87BA6CF3CD5058B01

Function 00007FF6CB9D27B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF6CB9D27D6
GetProcAddress.KERNEL32 ref: 00007FF6CB9D2813
FreeLibrary.KERNEL32 ref: 00007FF6CB9D2824

Part of subcall function 00007FF6CB9D23C0: GetFullPathNameW.KERNEL32 ref: 00007FF6CB9D242C
Part of subcall function 00007FF6CB9D23C0: GetFileAttributesW.KERNEL32 ref: 00007FF6CB9D2444
Part of subcall function 00007FF6CB9D23C0: LoadLibraryW.KERNEL32 ref: 00007FF6CB9D2462
Part of subcall function 00007FF6CB9D23C0: GetProcAddress.KERNEL32 ref: 00007FF6CB9D2486
Part of subcall function 00007FF6CB9D23C0: FreeLibrary.KERNEL32 ref: 00007FF6CB9D24F7

Strings

SetupSetNonInteractiveMode, xrefs: 00007FF6CB9D2804
setupapi.dll, xrefs: 00007FF6CB9D27C9

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Library$AddressFreeLoadProc$AttributesFileFullNamePath
String ID: SetupSetNonInteractiveMode$setupapi.dll
API String ID: 1784877336-1268865691
Opcode ID: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
Instruction ID: 0e69d46960c86ec0f40749b6ce4bbe126346d0cceb292a3df7538b1e1da5781d
Opcode Fuzzy Hash: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
Instruction Fuzzy Hash: 92213B25B0CB6186EA149F67B444429B7A1FB8DFD5F410534EECD87B25DE3CE0468706

Function 00007FF6CBA2071C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6CBA2074D
GetLastError.KERNEL32 ref: 00007FF6CBA20759
CloseHandle.KERNEL32 ref: 00007FF6CBA20771
CreateFileW.KERNEL32 ref: 00007FF6CBA2079C
WriteConsoleW.KERNEL32 ref: 00007FF6CBA207BB

Strings

CONOUT$, xrefs: 00007FF6CBA2077D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
Instruction ID: 30cf33f18ff566a78292af4bfa5bacb57c435279fffeef31aee88be477ec38a7
Opcode Fuzzy Hash: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
Instruction Fuzzy Hash: 63118E21A18B6186E3508F87E85872962A4FB9CFE6F044234EADDC7BA4DF3CD4548B45

Function 00007FF6CBA20584 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6CBA205A9
GetLastError.KERNEL32 ref: 00007FF6CBA205B5
CloseHandle.KERNEL32 ref: 00007FF6CBA205CD
CreateFileW.KERNEL32 ref: 00007FF6CBA205F8
WriteConsoleW.KERNEL32 ref: 00007FF6CBA20619

Strings

CONOUT$, xrefs: 00007FF6CBA205D9

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
Instruction ID: af420400c9149537c9ebe31eab910709ced6708efca97cc5fb4e383fc255b2b7
Opcode Fuzzy Hash: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
Instruction Fuzzy Hash: D011BF32A0CB1686E7108F96F4087296360FB8CBAAF044230DADDC7BA4CF3CD4548B01

Function 00007FF6CB9E43FC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6CB9E4467
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6CB9E44AB

Strings

MOC, xrefs: 00007FF6CB9E447B
p(+E, xrefs: 00007FF6CB9E4415
RCC, xrefs: 00007FF6CB9E4483

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC$p(+E
API String ID: 3544855599-2665859282
Opcode ID: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
Instruction ID: 49ea042bc6e2114ebfe1a0cf8a78ca04881d8be656fcdc5e51df00b483928458
Opcode Fuzzy Hash: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
Instruction Fuzzy Hash: 1A91B273A08BA18AE711CF65E8502AD77A0FB49789F104139EE8D97766DF3CE191CB40

Function 00007FF6CB9E0034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E0179
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E0197
DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9E01A3
DName::operator+=.LIBCMT ref: 00007FF6CB9E01B7

Strings

..., xrefs: 00007FF6CB9E01AD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Name::operator+=$Replicator::operator+=
String ID: ...
API String ID: 3157425598-440645147
Opcode ID: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
Instruction ID: cc55f7dc9c77c5653a2950c869af1767978af33d926c1fc2252b52b09d30bc5c
Opcode Fuzzy Hash: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
Instruction Fuzzy Hash: 3C51D022E086A689FB15CF65D84133D26A8BB4EB86F548035DACC8B6B6DF3DE441C340

Function 00007FF6CB9D56D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D5714
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6CB9D573E

Strings

p(+E, xrefs: 00007FF6CB9D56DF
%s, xrefs: 00007FF6CB9D57B9
%-60s: %s, xrefs: 00007FF6CB9D57A3

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DetailDeviceDevice_Get_InfoListSetup
String ID: %-60s: %s$%s$p(+E
API String ID: 3680031113-3872658301
Opcode ID: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
Instruction ID: 59423371a06387324ae5508a01c37271c734deb658aa41242bdf24f541a2dc8a
Opcode Fuzzy Hash: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
Instruction Fuzzy Hash: 3C21C571B0866285FB208F26F4543BA63A0EF89BC5F944031DA8D87AB6DF2CD905C740

Function 00007FF6CB9D6B80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D6BB9
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF6CB9D6BE3

Strings

p(+E, xrefs: 00007FF6CB9D6B8F
%s, xrefs: 00007FF6CB9D6C5F
%-60s: %s, xrefs: 00007FF6CB9D6C51

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DetailDeviceDevice_Get_InfoListSetup
String ID: %-60s: %s$%s$p(+E
API String ID: 3680031113-3872658301
Opcode ID: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
Instruction ID: 63afa4861ec42efbfc23e293f38dc1239aaec4c3666022c8c3608a5096b43442
Opcode Fuzzy Hash: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
Instruction Fuzzy Hash: CA218272B08A9685FB208F66F4543BA6360FF99785F844135DBCD87AA5DF2CD505C700

Function 00007FF6CBA094F4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09527
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA0954E

Part of subcall function 00007FF6CBA081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA08300

Strings

p(+E, xrefs: 00007FF6CBA094FE
GetUserObjectInformationW, xrefs: 00007FF6CBA09534, 00007FF6CBA09547
GetProcessWindowStation, xrefs: 00007FF6CBA0950D, 00007FF6CBA09520

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: GetProcessWindowStation$GetUserObjectInformationW$p(+E
API String ID: 1640347226-3222003772
Opcode ID: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
Instruction ID: 9db9ca64135ecd8918289396d6715b4b8239e50d164b9d1b091809f42c590c67
Opcode Fuzzy Hash: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
Instruction Fuzzy Hash: 7D114D31A1C69682EA418FA6F9451B523A0EF4D745F840136D9CE877B4DF3CE549C704

Function 00007FF6CBA016E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6CBA01700
GetProcAddress.KERNEL32 ref: 00007FF6CBA01716
FreeLibrary.KERNEL32 ref: 00007FF6CBA01733

Strings

CorExitProcess, xrefs: 00007FF6CBA0170F
mscoree.dll, xrefs: 00007FF6CBA016F7

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
Instruction ID: 3f560bfdafe31bceafeefb6615b5b5b4416cd1ef01e3f1fb467d74b14d9b0727
Opcode Fuzzy Hash: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
Instruction Fuzzy Hash: 76F03AA1A196A281EF488FA6F4983B42361EF4C786F481035E6CF87575CF2CE488C701

Function 00007FF6CB9E30D0 Relevance: 7.8, APIs: 5, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6CB9E31F3
__AdjustPointer.LIBCMT ref: 00007FF6CB9E323E

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
Instruction ID: 45813966b4df0a63525780e44c09a5eb0f61dcbf24ed23e892c45ea6b2d034be
Opcode Fuzzy Hash: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
Instruction Fuzzy Hash: 6CB1B121A0E6E681EA669F51D54067E6390FF4EB82F098435DECD877A7DE3CE4428390

Function 00007FF6CBA22044 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6CBA22080
_set_statfp.LIBCMT ref: 00007FF6CBA2209E
_set_statfp.LIBCMT ref: 00007FF6CBA220C7
_set_statfp.LIBCMT ref: 00007FF6CBA22280

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
Instruction ID: 9ead5d435e850569dd1fa06dce6e12956a68110f3152f5fcdb688856139bebdc
Opcode Fuzzy Hash: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
Instruction Fuzzy Hash: 8B510623D0CB6681F6269EB6984877A7250FF58352F048635EEDEA75F0DF3CA4818702

Function 00007FF6CBA217D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6CBA217FC
_set_statfp.LIBCMT ref: 00007FF6CBA21817
_set_statfp.LIBCMT ref: 00007FF6CBA21833
_set_statfp.LIBCMT ref: 00007FF6CBA2186F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
Instruction ID: ce9aba608dd758c9647fc2bd85e500b7162844dde2044ee82e6a94e59eff10c8
Opcode Fuzzy Hash: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
Instruction Fuzzy Hash: 07114F22E9CA3305F6541EE6D48E3752181EF5D36AF590634E9EE876F79E3CA8418203

Function 00007FF6CB9F0EDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0F18
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F116B

Strings

, xrefs: 00007FF6CB9F0F2B
*, xrefs: 00007FF6CB9F1093

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
Instruction ID: 9eb32ec9d532cd0c3ed025a06b183f6870f1f142f234a58297b7d461df078260
Opcode Fuzzy Hash: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
Instruction Fuzzy Hash: 4E81B97294C27286E7649F25804507C37B0EB0BB6AF548135EAC9C62B7DF3DE541C794

Function 00007FF6CB9F0734 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0770
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F09C3

Strings

*, xrefs: 00007FF6CB9F08EB
, xrefs: 00007FF6CB9F0783

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
Instruction ID: 647181a7409ed0725ffd718e13b4847e1629599b526866fd4e018c6759bf46d7
Opcode Fuzzy Hash: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
Instruction Fuzzy Hash: A981917280826385FB649F29805517D7BECEB0AB6AF544035EAC9C62B7EF39E4C1C750

Function 00007FF6CB9EF940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9EF977
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9EF9B1

Strings

, xrefs: 00007FF6CB9EFB83
*, xrefs: 00007FF6CB9EFB19

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
Instruction ID: 3ba4ca8abd3bb6a9af3ae3fdd460cd80534d634797ed8f30766695db3181224c
Opcode Fuzzy Hash: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
Instruction Fuzzy Hash: 2681527290C2A285FF648E35506427C3BA1FB1BB5AF184137CACEC62A7DE39E441C795

Function 00007FF6CB9F0018 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0056
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0288

Strings

*, xrefs: 00007FF6CB9F01C0
, xrefs: 00007FF6CB9F022A

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
Instruction ID: 40e7187c517c042f0de6fa824cc0f999bbb87d670eb013cef27ffc766ae73d34
Opcode Fuzzy Hash: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
Instruction Fuzzy Hash: 6581B972D4C26286EB658F2850441BC3BACEB0BB6AF144135EACDC62B7CF39E445C724

Function 00007FF6CBA0C164 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA0C1A7

Strings

-, xrefs: 00007FF6CBA0C382
e+000, xrefs: 00007FF6CBA0C24C
gfff, xrefs: 00007FF6CBA0C2C9

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
Instruction ID: 14a73f70436cde7efbd01d1970c6de066123438740d8f05ddf7f1c14d879f3d3
Opcode Fuzzy Hash: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
Instruction Fuzzy Hash: 4671F662B187D296E7208FA9A94036DB791E748B90F088231DBDD87BE9DE3CD440C701

Function 00007FF6CB9EF718 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9EF928

Part of subcall function 00007FF6CB9FD4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9FD576

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9EF75C

Strings

*, xrefs: 00007FF6CB9EF85E
, xrefs: 00007FF6CB9EF8B3

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
Instruction ID: d363d216d018f3b09d265c9ea39dd3fd81094a1ac24c5876d58927f76be5fa53
Opcode Fuzzy Hash: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
Instruction Fuzzy Hash: 09612F729082A286FF688F29945437C37A1FB0FB1AF14113BC6CB821BACF29D545D681

Function 00007FF6CB9EFBE8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9EFC14
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9EFC46

Strings

, xrefs: 00007FF6CB9EFD99
*, xrefs: 00007FF6CB9EFD44

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
Instruction ID: a4e1988961f9f028bb0b388fdc18759f33c6d007664eaf82cf4b18f2c8f97f21
Opcode Fuzzy Hash: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
Instruction Fuzzy Hash: D561437290C6E286FB658E34905537C3BA5FB5BB1AF141137DA8BC21FACF28D4C18691

Function 00007FF6CB9F02B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F02E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F04B1

Strings

*, xrefs: 00007FF6CB9F03E5
, xrefs: 00007FF6CB9F043A

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
Instruction ID: 75f22e35c95e7199ac085dfc502b1057241b939c4e03d24749e8904d1b4cea82
Opcode Fuzzy Hash: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
Instruction Fuzzy Hash: 1A615472D0C6628BE7648E28905437C37ADFB0BB2EF141135E6CA822B6EF7CD485C645

Function 00007FF6CB9E41E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6CB9E423B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6CB9E4280

Strings

RCC, xrefs: 00007FF6CB9E4258
MOC, xrefs: 00007FF6CB9E424F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
Instruction ID: 677f692a8f8792f4a1145b8e27b9816afff08ba30da4c0529b3182e74255b417
Opcode Fuzzy Hash: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
Instruction Fuzzy Hash: B8517C32A08B958AEB10DF65D5803AD77A0FB49B89F045225EF8D53B6ADF3CE055C740

Function 00007FF6CB9E54F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6CB9E5596
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6CB9E55C2
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E56E1

Strings

csm, xrefs: 00007FF6CB9E56B4

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CreateDestructExceptionFrameInfoObject__except_validate_context_record
String ID: csm
API String ID: 146877497-1018135373
Opcode ID: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
Instruction ID: 371973a0e7a6b259f7b94b25e00eee6397d1f4ed46f62874403e7506a4d9d8af
Opcode Fuzzy Hash: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
Instruction Fuzzy Hash: 9251627661879186D660EF26E44026E77A0F78AB91F000235EBCD87B66DF3CE490C740

Function 00007FF6CBA16F00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6CBA17017
GetLastError.KERNEL32 ref: 00007FF6CBA17039

Strings

p(+E, xrefs: 00007FF6CBA16F1F
U, xrefs: 00007FF6CBA16FC3

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U$p(+E
API String ID: 442123175-1805567240
Opcode ID: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
Instruction ID: 0a8c2c2d67feb12f13047e227e7406ae76b3760f41967536d30817f48e676826
Opcode Fuzzy Hash: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
Instruction Fuzzy Hash: 7641F262B18A6286DB608F65E4443AA77A0FB9C784F844031EECDC77A8DF3CD445C740

Function 00007FF6CB9D2A40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6CB9D2A90
LoadStringW.USER32 ref: 00007FF6CB9D2AB0
LoadStringW.USER32 ref: 00007FF6CB9D2AD3

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D2A4B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: LoadString$FormatFreeLocalMessage
String ID: p(+E
API String ID: 725706356-992973349
Opcode ID: d36bfa7664a5711998a406ac07652836b212a39b1eab9331ee2aa3cf872bf64b
Instruction ID: 7e079bf7b3cce9a3e16b9871d8f5fd9b0720aa9b763f8e544470f8813e348fa2
Opcode Fuzzy Hash: d36bfa7664a5711998a406ac07652836b212a39b1eab9331ee2aa3cf872bf64b
Instruction Fuzzy Hash: A1416231B1869286E7608F32F4517AB72A4FB8A746F504139DACD83BA6DF7CD8018B01

Function 00007FF6CB9D21E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6CB9D2230
LoadStringW.USER32 ref: 00007FF6CB9D2250
LoadStringW.USER32 ref: 00007FF6CB9D2273

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D21EB

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: LoadString$FormatFreeLocalMessage
String ID: p(+E
API String ID: 725706356-992973349
Opcode ID: 1f31b0bac141e3598676c149cf7d245e2a34e0ed7585f5e27d16a1bc5d19c6ad
Instruction ID: f790a411b0de396241b445caa24cd736c6b43aa973a5bd8d86b94698105bf106
Opcode Fuzzy Hash: 1f31b0bac141e3598676c149cf7d245e2a34e0ed7585f5e27d16a1bc5d19c6ad
Instruction Fuzzy Hash: B2414131B0869287EB648F22F4517AAB2A4FB99B45F504035DACD83BA6DF2CD9458B01

Function 00007FF6CB9D2050 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6CB9D20A0
LoadStringW.USER32 ref: 00007FF6CB9D20C0
LoadStringW.USER32 ref: 00007FF6CB9D20E3

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D205B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: LoadString$FormatFreeLocalMessage
String ID: p(+E
API String ID: 725706356-992973349
Opcode ID: b4980c883bb1a09f812c638c04d9d4c4efa02f1c2f7f414c115e6b7991347afb
Instruction ID: 8636f85fa3eec9b68f527e5e621b688accb31c0750eb2d8ee48b454122d94714
Opcode Fuzzy Hash: b4980c883bb1a09f812c638c04d9d4c4efa02f1c2f7f414c115e6b7991347afb
Instruction Fuzzy Hash: 2E415335B0869286E7648F62F4417AA72A4FB8E745F508135DBCD83BA6DF3CD8058B41

Function 00007FF6CB9D1EC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6CB9D1F10
LoadStringW.USER32 ref: 00007FF6CB9D1F30
LoadStringW.USER32 ref: 00007FF6CB9D1F53

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D1ECB

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: LoadString$FormatFreeLocalMessage
String ID: p(+E
API String ID: 725706356-992973349
Opcode ID: 65fa046dd147d147dcb4326ec258a0e4ee0eb08cbafcded7de64b22c94f2d531
Instruction ID: f0dd7f70d61118ce48589e912f247100497ec1a54262330407111e77e7e55439
Opcode Fuzzy Hash: 65fa046dd147d147dcb4326ec258a0e4ee0eb08cbafcded7de64b22c94f2d531
Instruction Fuzzy Hash: 71417131B0869286F7608F62F4407AA72A4FB8A785F504035DACD83BA6DF3DE845CB41

Function 00007FF6CB9D4C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF6CB9D4C83
GetLastError.KERNEL32 ref: 00007FF6CB9D4C94
RegQueryValueExW.ADVAPI32 ref: 00007FF6CB9D4CF6

Strings

LowerFilters, xrefs: 00007FF6CB9D4C3B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: QueryValue$ErrorLast
String ID: LowerFilters
API String ID: 181557691-1260524392
Opcode ID: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
Instruction ID: ea2bbfb63f21b6c79d49144798afeb38f2d10853f861fc17c06f8c965086d999
Opcode Fuzzy Hash: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
Instruction Fuzzy Hash: C2218122608B6556EA148F26F55426EA391EF9E791F840235EADD83BE6EF3CE041C700

Function 00007FF6CB9E562B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E5662
RaiseException.KERNEL32 ref: 00007FF6CB9E5688
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E56E1

Strings

csm, xrefs: 00007FF6CB9E56B4

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Exception$DestructObject$Raise
String ID: csm
API String ID: 2826525264-1018135373
Opcode ID: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
Instruction ID: 37e986a1c77c9d257d3566833c43d7d7116dc2a5d4e699aa7a48c35bfe4b686f
Opcode Fuzzy Hash: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
Instruction Fuzzy Hash: 3631F17660825187E670EF26E04026E7760FB89B96F414235DACE477B6CF3CE985CB41

Function 00007FF6CB9E53FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E5422
RaiseException.KERNEL32 ref: 00007FF6CB9E544B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF6CB9E54AC

Strings

csm, xrefs: 00007FF6CB9E547F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Exception$DestructObject$Raise
String ID: csm
API String ID: 2826525264-1018135373
Opcode ID: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
Instruction ID: 01f4405c02c4e51d90b2a56993e8ef9f61912bb6f9f153643df570f494ab5f8f
Opcode Fuzzy Hash: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
Instruction Fuzzy Hash: 03212C766086A186E770DF12E04126E7760FB89BA6F400221DFDD437A6DF3CE885CB51

Function 00007FF6CBA090A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA090DA
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09136

Strings

RoInitialize, xrefs: 00007FF6CBA0911C, 00007FF6CBA0912F
MessageBoxW, xrefs: 00007FF6CBA090BD, 00007FF6CBA090CE

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: MessageBoxW$RoInitialize
API String ID: 2742660187-1810702038
Opcode ID: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
Instruction ID: 25e8f321a6162250f919d4f38269d55b743f002928dd5167fb4651c4733db48a
Opcode Fuzzy Hash: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
Instruction Fuzzy Hash: 38117061B0969695EB084FC2F8450B56320EF5C792F480436DFDD4BB65CE3CEA858701

Function 00007FF6CB9D76E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(?,?,?,?,?,?,00007FF6CBA068CB), ref: 00007FF6CB9D7B5E
capture_previous_context.LIBCMT ref: 00007FF6CB9D7B75
__raise_securityfailure.LIBCMT ref: 00007FF6CB9D7C17

Strings

p(+E, xrefs: 00007FF6CB9D7BEF

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FeaturePresentProcessor__raise_securityfailurecapture_previous_context
String ID: p(+E
API String ID: 838830666-992973349
Opcode ID: 677a7e15bd34d26f6fc7f08ca98fa283d58bc0425ea408ef339a664e35e7bc6a
Instruction ID: 00ff77e72463278423061f8a22c4d14df42c6b362246b8fd21ba0df76ed1d698
Opcode Fuzzy Hash: 677a7e15bd34d26f6fc7f08ca98fa283d58bc0425ea408ef339a664e35e7bc6a
Instruction Fuzzy Hash: 9B21F474A08B2685EA408FA9F88136566A4FBA9346F900136E9CDC73B6DF7DE804C701

Function 00007FF6CBA09188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA091B1
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA091FB

Strings

SetThreadStackGuarantee, xrefs: 00007FF6CBA091E1, 00007FF6CBA091F4
SystemFunction036, xrefs: 00007FF6CBA09194, 00007FF6CBA0919E

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function
String ID: SetThreadStackGuarantee$SystemFunction036
API String ID: 2742660187-2910880125
Opcode ID: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
Instruction ID: 12436afd5f8bf841572f96fae3a74f0c62c4a9aeb9b066f161000aff0786e882
Opcode Fuzzy Hash: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
Instruction Fuzzy Hash: 66012C61A1969695FB099FD6E8490B02311EF5C342F480032DEED4B6B1DE7CEE958316

Function 00007FF6CBA09448 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA09468
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA0949A

Part of subcall function 00007FF6CBA081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA08300

Strings

GetLastActivePopup, xrefs: 00007FF6CBA09480, 00007FF6CBA09493
GetActiveWindow, xrefs: 00007FF6CBA0944E, 00007FF6CBA09461

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: GetActiveWindow$GetLastActivePopup
API String ID: 1640347226-3742175580
Opcode ID: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
Instruction ID: 1fb22e971d831d77de5ab646f9b30b6e12ae4d570c98bdae4b83929191793ea4
Opcode Fuzzy Hash: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
Instruction Fuzzy Hash: BDF0E778A0966781FE149FD6A8651B01290DF1C753F850436C9CE8B3B0DE3CAA858316

Function 00007FF6CBA0921C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA0924C
try_get_function.LIBVCRUNTIME ref: 00007FF6CBA0926E

Part of subcall function 00007FF6CBA081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF6CBA08A2A,?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85), ref: 00007FF6CBA08300

Strings

MessageBoxW, xrefs: 00007FF6CBA09256, 00007FF6CBA09264
MessageBoxA, xrefs: 00007FF6CBA09234, 00007FF6CBA09242

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: try_get_function$AddressProc
String ID: MessageBoxA$MessageBoxW
API String ID: 1640347226-1053882329
Opcode ID: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
Instruction ID: 256a0634fbf339420394a603ced0c41915c42ec72688d54286f2141622425000
Opcode Fuzzy Hash: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
Instruction Fuzzy Hash: CFF03C61A0965791EE04DFA1F9814F46360EF6C346F840036D9CD83175DE7CEE4ACB84

Function 00007FF6CBA1E2A8 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FF6CBA1E2F6
GetLastError.KERNEL32 ref: 00007FF6CBA1E300
SetFilePointerEx.KERNEL32 ref: 00007FF6CBA1E324
SetFilePointerEx.KERNEL32 ref: 00007FF6CBA1E349

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
Instruction ID: 5c5c7597ff4602ba0eae5b1efa0eede9e1a5471958b2a96826264d8e4381d8ba
Opcode Fuzzy Hash: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
Instruction Fuzzy Hash: 9C21B461A086A281EB509FA5B8451697761EB48BE5F584732EAEE87AF4CE3CD0408700

Function 00007FF6CB9D77B0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF6CB9D77C7
_RTC_Initialize.LIBCMT ref: 00007FF6CB9D77E8

Part of subcall function 00007FF6CB9D8390: _onexit.LIBCMT ref: 00007FF6CB9D8394

Part of subcall function 00007FF6CBA00610: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA00642

__scrt_fastfail.LIBCMT ref: 00007FF6CB9D7860
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF6CB9D7874

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2724578021-0
Opcode ID: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
Instruction ID: ee2b8c8b9c3270f50e0a7892c629134764a7fa61385be1e91649722e2eb8e303
Opcode Fuzzy Hash: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
Instruction Fuzzy Hash: E9118A10E0923342FA557FB365D62F911959FAE347F440874E5CEC62F3ED6CA8418622

Function 00007FF6CB9D2BD0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CM_Connect_MachineW.SETUPAPI ref: 00007FF6CB9D2BF7
CM_Locate_DevNode_ExW.SETUPAPI ref: 00007FF6CB9D2C10
CM_Reenumerate_DevNode_Ex.SETUPAPI ref: 00007FF6CB9D2C48
CM_Disconnect_Machine.SETUPAPI ref: 00007FF6CB9D2C78

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
String ID:
API String ID: 218754429-0
Opcode ID: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
Instruction ID: d047f39f53348a31f51fe569a17f0d355835c4a3ccb65566eddf66c0d2775dc1
Opcode Fuzzy Hash: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
Instruction Fuzzy Hash: 6D11AF36A086A282EB24DF72F45456A73A1FFDDB85F458131DACD87A79DF2CD9018A00

Function 00007FF6CB9DAF10 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 00007FF6CB9DAF37

Part of subcall function 00007FF6CB9DAB98: _HeapManager::getMemory.LIBVCRUNTIME ref: 00007FF6CB9DABC7

DName::operator+=.LIBVCRUNTIME ref: 00007FF6CB9DAF48

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: HeapManager::getMemoryName::operator+=Name::operator=
String ID:
API String ID: 2929307750-0
Opcode ID: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
Instruction ID: b7269ff66533c1802a25d48b5d01c1189b95c682ed7fdd24dbe049886fa198be
Opcode Fuzzy Hash: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
Instruction Fuzzy Hash: AC11CA719196A241FA515F77F40017DA791AB0AFC1F68C471D7DC837A7DE2DE8618301

Function 00007FF6CBA1E438 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FF6CBA1E45B
GetLastError.KERNEL32 ref: 00007FF6CBA1E465
SetFilePointerEx.KERNEL32 ref: 00007FF6CBA1E48C
SetFilePointerEx.KERNEL32 ref: 00007FF6CBA1E4AF

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
Instruction ID: 6ae4577158c746b1477caccf5c00945fb73cf5420518e21713899dfeb20749e3
Opcode Fuzzy Hash: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
Instruction Fuzzy Hash: 5D113072A0C6A181E7608FA5B80556ABBA0FB88BD6F544631DADD93AB4CE3DD4448B00

Function 00007FF6CBA10740 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA100B0: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF6CBA103FC,?,?,?,?,00000000,?,?,00007FF6CBA106A2), ref: 00007FF6CBA100DA

IsValidCodePage.KERNEL32(?,00000000,?,?,00000000,00000001,?,00007FF6CBA104AF,?,?,?,?,00000000,?,?,00007FF6CBA106A2), ref: 00007FF6CBA107AB
GetCPInfo.KERNEL32(?,00000000,?,?,00000000,00000001,?,00007FF6CBA104AF,?,?,?,?,00000000,?,?,00007FF6CBA106A2), ref: 00007FF6CBA107F7

Strings

p(+E, xrefs: 00007FF6CBA10754

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: p(+E
API String ID: 546120528-992973349
Opcode ID: 5b840e18b88d73fde16da412929cf6744591f2216113680c20e326a1e5a7132f
Instruction ID: 8282f0236aef7a52fbfdc1de00e0a8f5628e7ab5b6fb4a34b54d6d7ce5fafd5c
Opcode Fuzzy Hash: 5b840e18b88d73fde16da412929cf6744591f2216113680c20e326a1e5a7132f
Instruction Fuzzy Hash: 4681CD62E0C6A2C6F7B58FA7905417D77A9EB58742F0C8036C6CE876A1DE3CE940E340

Function 00007FF6CB9F0C54 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0C8C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0ED3

Strings

*, xrefs: 00007FF6CB9F0D9B

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
Instruction ID: d2a846de8118afeea1c8f95d059de87a6ffa88f7eb506223a4881bb992a5f10b
Opcode Fuzzy Hash: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
Instruction Fuzzy Hash: 56717572909661C6E7788F28805417C3BADFB0EB6AF54013AEADE822B6DF39D441C754

Function 00007FF6CB9F04BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F04F4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F072A

Strings

*, xrefs: 00007FF6CB9F0603

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
Instruction ID: ff8ed7afba4e26b2bd219960aaecdb2f144145fdbc26a5f144e258ee66e96d76
Opcode Fuzzy Hash: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
Instruction Fuzzy Hash: 8F71DD7290923286E7685F69805407D37BCFB4EB2BF141235EACA862B7DF39D481C704

Function 00007FF6CB9F1190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F11C8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F1402

Strings

*, xrefs: 00007FF6CB9F12D5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
Instruction ID: 4fbb00805040a2f9bcccd52088424e9f145fe45f5349e10a62213c8c8ebd5168
Opcode Fuzzy Hash: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
Instruction Fuzzy Hash: 2071A872958632C7E7648F29804407C3BB0FB4EB6AF141136EACAC26B6DF79D481C794

Function 00007FF6CB9F09E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0A20
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F0C49

Strings

*, xrefs: 00007FF6CB9F0B2D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
Instruction ID: ad86b11341dbedd6c4ba897d4968c0256fd140dbfcb99ebd17de2b29c2cbbd82
Opcode Fuzzy Hash: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
Instruction Fuzzy Hash: E9718772D1826286EB644F39904417D3BADEB0AB6FF551136EACA832B6DF38D481C714

Function 00007FF6CBA101E8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6CBA1022A

Strings

p(+E, xrefs: 00007FF6CBA10202
, xrefs: 00007FF6CBA1026F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Info
String ID: $p(+E
API String ID: 1807457897-2365856657
Opcode ID: 96040809381d7ca1bd8e5ac58f77e2e9585471639ab3a0bffb4939a1f81211f0
Instruction ID: 0bb4677c7994db89e134c2173e2237c289f6b9649d6542cd6e9b7ad0938abce2
Opcode Fuzzy Hash: 96040809381d7ca1bd8e5ac58f77e2e9585471639ab3a0bffb4939a1f81211f0
Instruction Fuzzy Hash: DA51F132A1C6A0CBE7A18F65D0803AE7BA4F748B45F584136E6CD876A9CF2CC545DB84

Function 00007FF6CB9D69A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF6CB9D69D9
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF6CB9D6A02

Part of subcall function 00007FF6CB9D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D47B7
Part of subcall function 00007FF6CB9D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF6CB9D10DD), ref: 00007FF6CB9D480B

Strings

p(+E, xrefs: 00007FF6CB9D69AD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DetailDeviceFormatFreeGet_InfoListLocalMessageNode_SetupStatus_
String ID: p(+E
API String ID: 1740131299-992973349
Opcode ID: ebf96f282650d0b220f84d56cfbe693d03f8d1ef8f9cad215f6e74dec256d938
Instruction ID: 216cf576bdc4d0be907e2d68338b823d04bc3d89996183f47d9b903de94498b6
Opcode Fuzzy Hash: ebf96f282650d0b220f84d56cfbe693d03f8d1ef8f9cad215f6e74dec256d938
Instruction Fuzzy Hash: BF412E31A1D19246FB54AF72F4553BA2251EF8A741F404439E6CE8B7E7DE2CE8404791

Function 00007FF6CBA00610 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CBA00642

Part of subcall function 00007FF6CBA079F8: HeapFree.KERNEL32(?,?,?,00007FF6CBA132DC,?,?,?,00007FF6CBA136FF,?,?,00000000,00007FF6CBA13F44,?,?,?,00007FF6CBA13E77), ref: 00007FF6CBA07A0E
Part of subcall function 00007FF6CBA079F8: GetLastError.KERNEL32(?,?,?,00007FF6CBA132DC,?,?,?,00007FF6CBA136FF,?,?,00000000,00007FF6CBA13F44,?,?,?,00007FF6CBA13E77), ref: 00007FF6CBA07A20

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6CB9D7805), ref: 00007FF6CBA00660

Strings

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF6CBA0064E

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
API String ID: 3580290477-2985852448
Opcode ID: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
Instruction ID: eee4049ece2cda5a368109530609188462886aeb111c64ab5b42c06e57fa0afa
Opcode Fuzzy Hash: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
Instruction Fuzzy Hash: 32419336A08BA686E7649FA6B8400BD2795EF4C7D6F544035E9CF83BA5DF3DD4808700

Function 00007FF6CB9FFD7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9FFDB3

Strings

C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF6CB9FFDBF

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
API String ID: 3215553584-2985852448
Opcode ID: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
Instruction ID: 8e218bec7b48568542fd6080e43b635eaba2db69d29e13d91854dc608ac98a97
Opcode Fuzzy Hash: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
Instruction Fuzzy Hash: B941B332A09A6289EB54DF65A8401AC7795EB4D7E6F544032E9CEC7BB6DF3DE4408300

Function 00007FF6CB9F63EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F648B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F64E5

Strings

(null), xrefs: 00007FF6CB9F6520

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
Instruction ID: a67a4ecf55c96e10014cd813a0ef917061ceb79ee4d3fa07705c2a2f2d0530f0
Opcode Fuzzy Hash: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
Instruction Fuzzy Hash: C441B4B29087A286EB559F28D1442BC37A1EB1BB5AF144039D6CD8737ADF3AD445C700

Function 00007FF6CB9F61AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F624B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F62A5

Strings

(null), xrefs: 00007FF6CB9F62E0

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
Instruction ID: 5aaf22e15df99417febadcf7424470bd2179b4a9809bde3d1964007f3cf43ded
Opcode Fuzzy Hash: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
Instruction Fuzzy Hash: 7641B3729087A286EB544F6891442FC37A0EB1BB6AF144039DACDC73B6DF3AD455D710

Function 00007FF6CB9F686C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F6903
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F695F

Strings

(null), xrefs: 00007FF6CB9F6981

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
Instruction ID: ef66db20e29844cfda6d5587317574f2d4a3a1ca6e55cd4abc94fdba497ade6c
Opcode Fuzzy Hash: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
Instruction Fuzzy Hash: CE318B729087A286EB548F19D14027C77A0EB1AF9AF144039DACC4B7B6CF3AE492C710

Function 00007FF6CB9F6634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F66CB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6CB9F6727

Strings

(null), xrefs: 00007FF6CB9F6749

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: (null)
API String ID: 3215553584-3941151225
Opcode ID: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
Instruction ID: c6fb03f1a575fa24335ce4e6ee68f05ecc3f747cc30f35a66e6cab96a60627b2
Opcode Fuzzy Hash: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
Instruction Fuzzy Hash: 6A318D729087A1C6EB548F19D14427C37A0EB1AB5AF14403AEB8D477BADF3AE452C710

Function 00007FF6CB9D93B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FF6CB9D940D
InterlockedPushEntrySList.KERNEL32 ref: 00007FF6CB9D948F

Strings

, xrefs: 00007FF6CB9D9430

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: EntryInterlockedListNamePush__un
String ID:
API String ID: 524438517-3916222277
Opcode ID: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
Instruction ID: 6d4a2511b250d6f2dd86697af1276e1f3e5a6d1a8d3e2db2b203726e69fbf0d8
Opcode Fuzzy Hash: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
Instruction Fuzzy Hash: D731F412A29BB250EA45EF77B4045A923A0FB4DFE5F584635DEAD833A2DE39D442C310

Function 00007FF6CBA16DE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6CBA16EAE
GetLastError.KERNEL32 ref: 00007FF6CBA16ECA

Strings

p(+E, xrefs: 00007FF6CBA16DFF

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: p(+E
API String ID: 442123175-992973349
Opcode ID: 196d2737a4856dd4951fe7d117a6c3d55096706a26f5aa394971ab924e1e22fe
Instruction ID: 4d279c233341308450e37821e7fb7689f2f5e0e63f60bf12a8af8110182da66d
Opcode Fuzzy Hash: 196d2737a4856dd4951fe7d117a6c3d55096706a26f5aa394971ab924e1e22fe
Instruction Fuzzy Hash: E531AF72B18A619ADB50DF69E8842A963A0FB58781F488132EBCDC77B4EF3CD451C700

Function 00007FF6CBA21F08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA22044: _set_statfp.LIBCMT ref: 00007FF6CBA22080
Part of subcall function 00007FF6CBA22044: _set_statfp.LIBCMT ref: 00007FF6CBA22280

_errcode.LIBCMT ref: 00007FF6CBA21F97
_set_errno_from_matherr.LIBCMT ref: 00007FF6CBA21FCE

Strings

p(+E, xrefs: 00007FF6CBA21F25

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _set_statfp$_errcode_set_errno_from_matherr
String ID: p(+E
API String ID: 600688971-992973349
Opcode ID: 945dbe360878d75d3b19d27f412be1c4919e427d18897cade314b7d887b10064
Instruction ID: 6acf0d22b0f5390a05eef06795c5c3848bee435a2192ee499db5b6a851408193
Opcode Fuzzy Hash: 945dbe360878d75d3b19d27f412be1c4919e427d18897cade314b7d887b10064
Instruction Fuzzy Hash: 1631BC22B18B558AE7109F7AD4402ED33A0EF9D389F001236EE8C97B76DF38D9468740

Function 00007FF6CBA21E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6CBA22044: _set_statfp.LIBCMT ref: 00007FF6CBA22080
Part of subcall function 00007FF6CBA22044: _set_statfp.LIBCMT ref: 00007FF6CBA22280

_errcode.LIBCMT ref: 00007FF6CBA21E93
_set_errno_from_matherr.LIBCMT ref: 00007FF6CBA21ECA

Strings

p(+E, xrefs: 00007FF6CBA21E2D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _set_statfp$_errcode_set_errno_from_matherr
String ID: p(+E
API String ID: 600688971-992973349
Opcode ID: 036a27109eb4557990dde29ed4abb6a369c9833025f88aeb1d558d4a205e67ca
Instruction ID: 1cb2500b8ac994613b114f60626bd7857ebed6e8cf7b30b7c10bd837e6f36896
Opcode Fuzzy Hash: 036a27109eb4557990dde29ed4abb6a369c9833025f88aeb1d558d4a205e67ca
Instruction Fuzzy Hash: F321AD22B19B5189E7109FB6D5401FE23A5EF9D39AF400635EE8C6BB69DE38E4468340

Function 00007FF6CBA0FB94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6CBA0FBD0
GetLastError.KERNEL32 ref: 00007FF6CBA0FBDA

Strings

p(+E, xrefs: 00007FF6CBA0FBAE

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: p(+E
API String ID: 2776309574-992973349
Opcode ID: 6465f289e8acee930b69b432aa3160f15189e5a258fd916bd11453f2c5391746
Instruction ID: dbffb32cf4f19ecce31ef2ac33e6153bcd251ff69ecf6d4b02f0b6e2e8e58979
Opcode Fuzzy Hash: 6465f289e8acee930b69b432aa3160f15189e5a258fd916bd11453f2c5391746
Instruction Fuzzy Hash: 3F31A23261CBD18AEB608F65E48536A77A0FB8D791F544135EACD83AA8DF3DD540CB00

Function 00007FF6CB9D33A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6CB9D33F9
SetupCopyOEMInfW.SETUPAPI ref: 00007FF6CB9D343E

Strings

p(+E, xrefs: 00007FF6CB9D33A9

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CopyFullNamePathSetup
String ID: p(+E
API String ID: 3256112836-992973349
Opcode ID: b876afb760d7cbc986b0fb1c19b85da168bdb41f916c9f3f4f402d97dbbdd920
Instruction ID: 29bb0ab33ea12d29fb4040577995a11a5716f6d21964650351f3986cc84ce0fe
Opcode Fuzzy Hash: b876afb760d7cbc986b0fb1c19b85da168bdb41f916c9f3f4f402d97dbbdd920
Instruction Fuzzy Hash: 86215E76A0C69286F7609F61F0543AB72A1FB8A746F504135DACE83BA6CF7DD4448B40

Function 00007FF6CBA22648 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF6CBA226F4
_set_errno_from_matherr.LIBCMT ref: 00007FF6CBA22708

Strings

exp, xrefs: 00007FF6CBA2266F

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
Instruction ID: 9949900d725490d1672e60a5bd8b5be2cec6e52e13ecb5b89e431cdb0fe24f1d
Opcode Fuzzy Hash: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
Instruction Fuzzy Hash: ED21F836A197958BE760CF69A54426AB2A0FB8D701F504635FACDC3B66EF3CE4408F01

Function 00007FF6CBA08EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08ED9
LCMapStringW.KERNEL32 ref: 00007FF6CBA08F61

Strings

LCMapStringEx, xrefs: 00007FF6CBA08EBC, 00007FF6CBA08ECD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
Instruction ID: bf22b9390d02451fd52f73eab4b166d058f963f7b5d1ed0ab479b973d63dddb0
Opcode Fuzzy Hash: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
Instruction Fuzzy Hash: F7112932608BD186D7648F56B4402AAB7A1FBCCB91F544136EECD83B29CF3CD5548B00

Function 00007FF6CBA087B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA087E9
CompareStringW.KERNEL32 ref: 00007FF6CBA08871

Strings

CompareStringEx, xrefs: 00007FF6CBA087CC, 00007FF6CBA087DD

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
Instruction ID: ed25c4a11195c1d338018dc9c094e6908a75fc74b07e23833ba2c0894ba6adda
Opcode Fuzzy Hash: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
Instruction Fuzzy Hash: 65112C36608BD186D7648F56B4802AAB7A0FB8CB91F544136EECE83B29CF3CD5448B00

Function 00007FF6CBA08A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08A89
GetDateFormatW.KERNEL32 ref: 00007FF6CBA08AEB

Strings

GetDateFormatEx, xrefs: 00007FF6CBA08A6C, 00007FF6CBA08A7D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DateFormattry_get_function
String ID: GetDateFormatEx
API String ID: 595753042-159735388
Opcode ID: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
Instruction ID: 4c14c3fdb6b62111312642108e8f85838fc706e4849d8c2cc032e600f5f25aa3
Opcode Fuzzy Hash: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
Instruction Fuzzy Hash: 72112E75A08B91C6E614CF96B44019AB7A0FB9CBD1F184136EECE83B69CF3CD5548B44

Function 00007FF6CBA08C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08C49
GetTimeFormatW.KERNEL32 ref: 00007FF6CBA08CA0

Strings

GetTimeFormatEx, xrefs: 00007FF6CBA08C2C, 00007FF6CBA08C3D

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FormatTimetry_get_function
String ID: GetTimeFormatEx
API String ID: 3261793192-1692793031
Opcode ID: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
Instruction ID: baa37c21b0dc95045b7ba47e3faa69f01d9c6238b191d073acb30ed21c195332
Opcode Fuzzy Hash: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
Instruction Fuzzy Hash: 92114F75A0879186E7148FA6B44005AB7A0FB9CBD1F184136EECD93B79CE3CD5448B04

Function 00007FF6CBA1BA84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_Wcsftime.LIBCMT ref: 00007FF6CBA1BAF8
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00007FF6CBA0D7AE), ref: 00007FF6CBA1BB04

Strings

p(+E, xrefs: 00007FF6CBA1BA93

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DebugOutputStringWcsftime
String ID: p(+E
API String ID: 1554785689-992973349
Opcode ID: ef2b27e52e22e5a31665c6e438c562819fe6ea21584f44ec9e4e5116ab193a3d
Instruction ID: 59e1cc461c75a60237cb4e682c4b72a92490c0a4deaae89205b6fd8b02e12c6f
Opcode Fuzzy Hash: ef2b27e52e22e5a31665c6e438c562819fe6ea21584f44ec9e4e5116ab193a3d
Instruction Fuzzy Hash: 12017022A09B96D9EE508FA1D4501A82360EB1D779B884731EAFD877E5DF28D108C300

Function 00007FF6CB9FF8BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6CB9FF8DF
WriteFile.KERNEL32 ref: 00007FF6CB9FF944

Strings

p(+E, xrefs: 00007FF6CB9FF8C5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: FileHandleWrite
String ID: p(+E
API String ID: 3320372497-992973349
Opcode ID: c638fb5e686f4a98f41b6449f2b6e7137388decb92fcfd562bcf2c32de04e1f9
Instruction ID: 604f78a6d3ba79f8dcadcd06519db69c73af8ef979052d23f309eeb597b9c114
Opcode Fuzzy Hash: c638fb5e686f4a98f41b6449f2b6e7137388decb92fcfd562bcf2c32de04e1f9
Instruction Fuzzy Hash: 5A11C26261969186DB208F25E85836973A0EB8DBA1F804221EBDD43799EF3CD554CB00

Function 00007FF6CBA08CBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08CE5
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF6CBA14130), ref: 00007FF6CBA08CFC

Strings

GetUserDefaultLocaleName, xrefs: 00007FF6CBA08CC8, 00007FF6CBA08CD2

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
Instruction ID: 110ef0864eef994754f44c91c71f1c7cc0c176280bb7b9d00a2db58dba36918f
Opcode Fuzzy Hash: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
Instruction Fuzzy Hash: 9EF0BE10B1C5A282EB084FE6B5885B82261EF5C782F444036C9CE87B71CE2CD9858305

Function 00007FF6CBA08D74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08DA5
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF6CB9E69F1), ref: 00007FF6CBA08DBF

Strings

InitializeCriticalSectionEx, xrefs: 00007FF6CBA08D99

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
Instruction ID: edbd2c625e4c854ad62340aa326141a63a603f4ba7b8e27bcbc070aaef27d051
Opcode Fuzzy Hash: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
Instruction Fuzzy Hash: ABF0B461A186A282EA049F92F4040A42220FF4CB82F844135DADE43B64CF3CD9458751

Function 00007FF6CB9D8A74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6CB9D8A7D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6CB9D8A8E

Part of subcall function 00007FF6CB9D95E8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6CB9D8A93), ref: 00007FF6CB9D965D
Part of subcall function 00007FF6CB9D95E8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6CB9D8A93), ref: 00007FF6CB9D968F

Strings

Unknown exception, xrefs: 00007FF6CB9D8AA5

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
Instruction ID: 2990882a83f7de6bb76fef6db2d6788ff7379164485d12399b46c6ab291a8340
Opcode Fuzzy Hash: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
Instruction Fuzzy Hash: AED05E22A1899695EE10EF94E8843A86330FBC830AFA04431D6CCC35B2DF7CDA4AC740

Function 00007FF6CBA089FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CBA08A25
TlsSetValue.KERNEL32(?,?,00000000,00007FF6CBA077AE,?,?,00000000,00007FF6CBA06B85,?,?,?,?,00007FF6CB9E6CA8), ref: 00007FF6CBA08A3C

Strings

FlsSetValue, xrefs: 00007FF6CBA08A12

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
Instruction ID: bccddc04f0ce31ce42a2f280cfec3b87974ef4ba1c5a05345d61e760df19b0ae
Opcode Fuzzy Hash: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
Instruction Fuzzy Hash: 4DE06565A0855281FA084FD2F8040B82221EF8C782F595136D6DE87674CE3CD9948301

Function 00007FF6CB9DA544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6CB9DA56D
TlsSetValue.KERNEL32(?,?,?,00007FF6CB9D9CC5,?,?,?,?,00007FF6CB9D91A4,?,?,?,?,00007FF6CB9D814B), ref: 00007FF6CB9DA584

Strings

FlsSetValue, xrefs: 00007FF6CB9DA551, 00007FF6CB9DA55A

Memory Dump Source

Source File: 0000000B.00000002.2461626968.00007FF6CB9D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6CB9D0000, based on PE: true

Associated: 0000000B.00000002.2461594768.00007FF6CB9D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461739545.00007FF6CBA24000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461822453.00007FF6CBA37000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2461873714.00007FF6CBA3A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff6cb9d0000_tapinstall.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
Instruction ID: fe9971895b79a5b84abcef2a16eaa0188489bcbebd20757c15f3f3f05387fd98
Opcode Fuzzy Hash: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
Instruction Fuzzy Hash: 8EE065A1A0855285EB045FE3F4044BC6321EF8CB82F5A5031DBED87679CE3CD958C711

Analysis Process: FastestVPN.exePID: 3292, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.2%
Total number of Nodes:	58
Total number of Limit Nodes:	3

Executed Functions

Function 00FF27C8 Relevance: 1.6, APIs: 1, Instructions: 121
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00FF28F9

Memory Dump Source

Source File: 0000001D.00000002.3315970213.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_ff0000_FastestVPN.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 883eba7471ff41b403be5979f4c1826a2d85ace7797e747b3ce0ff2426d96568
Instruction ID: 8287751fc45123b87f20726cc2b0a1e7994e339dcb427f42181c1dfcb7633d04
Opcode Fuzzy Hash: 883eba7471ff41b403be5979f4c1826a2d85ace7797e747b3ce0ff2426d96568
Instruction Fuzzy Hash: 9951F4B1D002599FDB50CFA9C884B9EBBF1FF48360F14812AE918AB2A1D7759840DF91

Function 0C116700 Relevance: 4.2, Strings: 3, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 0C116897
$cq, xrefs: 0C11688D
(gq, xrefs: 0C116A99

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID: (gq$$cq$$cq
API String ID: 0-2160153951
Opcode ID: 6b91f6fa8e40dea2329b347726c28f3bee538df8996d48519f94db8cb7fd3a2d
Instruction ID: be1af1396bded26179ecfd72eedc6cfd6548432690724b159f51aaff8d2c7402
Opcode Fuzzy Hash: 6b91f6fa8e40dea2329b347726c28f3bee538df8996d48519f94db8cb7fd3a2d
Instruction Fuzzy Hash: 70F19170B042098FDB14DF69C844A6EBBF2FF85300F28C569E8499B352DB76E945CB91

Function 00FF2A5C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConnectNamedPipe.KERNEL32(?,?), ref: 00FF2AF6

Strings

$gq, xrefs: 00FF2AB8

Memory Dump Source

Source File: 0000001D.00000002.3315970213.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_ff0000_FastestVPN.jbxd

Similarity

API ID: ConnectNamedPipe
String ID: $gq
API String ID: 2191148154-38943176
Opcode ID: fb76325a537fede648bf6218cfe105f00d4a142bb332ab2f70821898dd3860c3
Instruction ID: d00cf0cfe16c4b96e1ff6aaf92b33310fbfc778474d802c19913b77297ed36bf
Opcode Fuzzy Hash: fb76325a537fede648bf6218cfe105f00d4a142bb332ab2f70821898dd3860c3
Instruction Fuzzy Hash: 9F3110B1D012489FCB24CFA9C589BEEBFF0BF48314F248059E949AB291C7795849DB61

Function 00FF1FD8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConnectNamedPipe.KERNEL32(?,?), ref: 00FF2AF6

Strings

$gq, xrefs: 00FF2AB8

Memory Dump Source

Source File: 0000001D.00000002.3315970213.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_ff0000_FastestVPN.jbxd

Similarity

API ID: ConnectNamedPipe
String ID: $gq
API String ID: 2191148154-38943176
Opcode ID: 1216bee485fd9443edb40ec3dca948530975d2e6afa88e87bbcd33b251615873
Instruction ID: d886ef547628c38b6e444eb63f983e386c5013db5242721324a2922724113fd5
Opcode Fuzzy Hash: 1216bee485fd9443edb40ec3dca948530975d2e6afa88e87bbcd33b251615873
Instruction Fuzzy Hash: E13101B1D00208DFCB64CF99C589BAEBFF4BF48314F208059E905BB291C7799944DB65

Function 00FF27BD Relevance: 1.6, APIs: 1, Instructions: 124
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 00FF28F9

Memory Dump Source

Source File: 0000001D.00000002.3315970213.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_ff0000_FastestVPN.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: da495c7d69f3fe90a1513705e658b439892222eab4a86fbac417c29db00945f9
Instruction ID: 9fced34182f66d3b511abc6d9de74b1ed45500a0681207141807d1e3522cf220
Opcode Fuzzy Hash: da495c7d69f3fe90a1513705e658b439892222eab4a86fbac417c29db00945f9
Instruction Fuzzy Hash: 54512871D002599FDB50CFA9C885B9EBFF1FF48320F14812AE818AB2A1D7759841DF91

Function 05E933DD Relevance: 1.6, APIs: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(?,-00000428), ref: 05E934DA

Memory Dump Source

Source File: 0000001D.00000002.3371079339.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_5e90000_FastestVPN.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: aea859a9e88499ac3c4ac182f069ee85893d45a794776181a85eb1c55d173107
Instruction ID: 92a6495150282f2bf37b1852e346daa14e9d071ca9749d29ef31f29ccbd32d71
Opcode Fuzzy Hash: aea859a9e88499ac3c4ac182f069ee85893d45a794776181a85eb1c55d173107
Instruction Fuzzy Hash: 684105F09052688FDB24CF69C984BDDBBF4AB48304F5480EAD64CA7252D7746A88CF59

Function 05E92634 Relevance: 1.6, APIs: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(?,-00000428), ref: 05E934DA

Memory Dump Source

Source File: 0000001D.00000002.3371079339.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_5e90000_FastestVPN.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 4e61c19096b87d5012cc279a5c76d24ef023b6fdf058d7e325187598b6aa94fd
Instruction ID: bede3d4ef385d391d74068cd9d03be0a51ce8605aadc7b8547a6e5af72757097
Opcode Fuzzy Hash: 4e61c19096b87d5012cc279a5c76d24ef023b6fdf058d7e325187598b6aa94fd
Instruction Fuzzy Hash: 1841E5F09012688FDB24CF59C984BDDFBF8AB48304F9084E9D64CA7251DB746A88CF59

Function 0BE601EC Relevance: 1.6, APIs: 1, Instructions: 95libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 0BE602CC

Memory Dump Source

Source File: 0000001D.00000002.3407015418.000000000BE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_be60000_FastestVPN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 20c1ac2710b7113653cd6dab5466dbee81c1f848105a05f10fcc86bb56bdfd55
Instruction ID: 54319f044d38e10716c4d74db74884f48abd7c3326287f2b643617e9d8633909
Opcode Fuzzy Hash: 20c1ac2710b7113653cd6dab5466dbee81c1f848105a05f10fcc86bb56bdfd55
Instruction Fuzzy Hash: DF4155B0C00268CFDB20CFA9C885B9DBBF1BF48394F148529E824A7286D7749841CF95

Function 0BE601F8 Relevance: 1.6, APIs: 1, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 0BE602CC

Memory Dump Source

Source File: 0000001D.00000002.3407015418.000000000BE60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BE60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_be60000_FastestVPN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 30e88668d8bbbeca61b01c2498df6e2563090297b8d7951110567412f6f6d542
Instruction ID: d616efb98e0e53891dc50b9f534b68f9e4052cd60f25fce5065b40157bbd1d43
Opcode Fuzzy Hash: 30e88668d8bbbeca61b01c2498df6e2563090297b8d7951110567412f6f6d542
Instruction Fuzzy Hash: CF3145B0D40268CFDB20CFA9C88579EBBF1FF48394F14952AE824A7246D7749841CF95

Function 05E92D08 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 05E92DB6

Memory Dump Source

Source File: 0000001D.00000002.3371079339.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_5e90000_FastestVPN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8466b41b2184420191da2fbea13c86bdf5182c0d358025a95f1716150507f9e8
Instruction ID: e89269b86ae4d240a075c52da3ca42cbdb6f040f24c2370542017ed4694471a0
Opcode Fuzzy Hash: 8466b41b2184420191da2fbea13c86bdf5182c0d358025a95f1716150507f9e8
Instruction Fuzzy Hash: 7B3103B6900619AFDF15CF99C884ADEBBB5FF4C314F01821AEA18A7250C335A954CFA0

Function 05E92D10 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 05E92DB6

Memory Dump Source

Source File: 0000001D.00000002.3371079339.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_5e90000_FastestVPN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c8bb88ae5124a8b5879b56ec493bba5e1a81195af751617dc2be644ef60ac2d3
Instruction ID: d7a5676ba44f916766a004825d9370d96802f36269f827fdf6dc6a82ea0ec5ed
Opcode Fuzzy Hash: c8bb88ae5124a8b5879b56ec493bba5e1a81195af751617dc2be644ef60ac2d3
Instruction Fuzzy Hash: 3631E3B6900219AFDF15CF99C884ADEFBB4FF4C314F01821AEA18A7250C375A954CFA0

Function 0C116480 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d74d0b8793501093570e54f77e4f839cc1c591265f04a8732333cdc87b94e87
Instruction ID: 68151216740089f7a24018868bc4f7348fed498200a47b7608159a83269bb45b
Opcode Fuzzy Hash: 0d74d0b8793501093570e54f77e4f839cc1c591265f04a8732333cdc87b94e87
Instruction Fuzzy Hash: 8951BF31B001148FCB55DF2DD854A6EBBE6EFC9350B24856AE845CB392CB3ADD42CB80

Function 00F6E1FC Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2a269042b143d26cb2a6a8b6b6c9897cb5fc522052a6afc768358a83e9c5a2
Instruction ID: 79ba9535861bffbed19fc739d1659c6550079db235dc89450d61fc91df96c13f
Opcode Fuzzy Hash: 3f2a269042b143d26cb2a6a8b6b6c9897cb5fc522052a6afc768358a83e9c5a2
Instruction Fuzzy Hash: FE31D477900200EFDF069F54C9C0F167F6AFB48324F248598EE094A256C336D852EB61

Function 00F6ECD0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbab94008b6b600d8228a52d86f5588cb389b1f775ec9c7c0d0d9e4d0a23691
Instruction ID: 90524b16ceed72f034ad4e62ee813f7b5c2ac2763ef788875883b181b998b45e
Opcode Fuzzy Hash: bbbab94008b6b600d8228a52d86f5588cb389b1f775ec9c7c0d0d9e4d0a23691
Instruction Fuzzy Hash: 0931E477504240EFCF069F54D9C0F26BF66FF88324F248598ED090A25AC336D866EBA1

Function 00F6EBD4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc612717b56f337ba8b32cf7347ad449c95a36760527fbaa89cc93c0ec27c4ff
Instruction ID: 24022978f81981d14976895ba164ac6793dec1a12c19fcfea6d5003fff917d5a
Opcode Fuzzy Hash: bc612717b56f337ba8b32cf7347ad449c95a36760527fbaa89cc93c0ec27c4ff
Instruction Fuzzy Hash: 9F21B7B7504240EFCF068F54D9C4B16BF65FB88324F248599E9094A25AC336D816EBA1

Function 00F5D6B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d88d92f00d5dd1824ff2450ec33417242f7d4efebf974663572024d4f6a5f35
Instruction ID: ad8207e4774e8984e76200a42b97a3ab68f94b31935595d98e46ed6eccf9920e
Opcode Fuzzy Hash: 4d88d92f00d5dd1824ff2450ec33417242f7d4efebf974663572024d4f6a5f35
Instruction Fuzzy Hash: 67216872500240DFCF15DF04E9C0B16BFA1FB8C324F208568EE080B246C336D81ADB62

Function 00F5D524 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8dc14ffa2d55002197a27694531bc6db3a3732c72013afc5568aec71f37ef4d
Instruction ID: dba137bf5ae30fdb49cb172d0990b300dfc757771615426fe2ad7a635228e96c
Opcode Fuzzy Hash: c8dc14ffa2d55002197a27694531bc6db3a3732c72013afc5568aec71f37ef4d
Instruction Fuzzy Hash: E6216AB2504200DFCB25DF14D9C0B26BF65FB98329F28C568EE090B246D336D84AE7A1

Function 00F6D320 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9c281a775940235de6938e9ba8da8bbd9f682bb76c306f112c69659f5c9853
Instruction ID: c3fdbf5ef7ac81a92b67e40d18b47291a01f98ff80abd2eec0bc27777406208d
Opcode Fuzzy Hash: 7e9c281a775940235de6938e9ba8da8bbd9f682bb76c306f112c69659f5c9853
Instruction Fuzzy Hash: C22104B1B04244DFCB05DF54D9C1B26BB65FB84324F24C96DE9494B386C33AD846EA62

Function 00F6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f081e2346c640cbc870ba3c012df88607ddb6ac644e3dd29b3c67376d14ae5
Instruction ID: 94d4f7bc43f338018f9219f27ed819bef88a7d38536061eefa732009b178e4dd
Opcode Fuzzy Hash: d3f081e2346c640cbc870ba3c012df88607ddb6ac644e3dd29b3c67376d14ae5
Instruction Fuzzy Hash: A5210775A04240EFCB15DF14D9C4B26BB65FB88324F24C56DD80A4B24AC33BD807DA61

Function 00F6ECCB Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bc481eaee44fe26e2c3f7c32ec89ccb704547cbd072a47f23f635c24031534
Instruction ID: e862240102f354a8467d20d3b257cf767b363241a113e5e6126c93d01729dba4
Opcode Fuzzy Hash: 81bc481eaee44fe26e2c3f7c32ec89ccb704547cbd072a47f23f635c24031534
Instruction Fuzzy Hash: A1217F76504240EFCF068F54D9C4B56BF72FF48324F248699ED090A26AC336D866EB91

Function 00F6E1FB Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15aab3c26004f4562f17e5c437c4ea7468c271c64161690821f2acf0f8d2450c
Instruction ID: eabc41582979ca1c53326e400d8b8fe1da2b45be627b1d6c10477cab2d81c3af
Opcode Fuzzy Hash: 15aab3c26004f4562f17e5c437c4ea7468c271c64161690821f2acf0f8d2450c
Instruction Fuzzy Hash: 84216D76900240EFDF46CF54D9C0B15BF72FB48324F248699EE090A26AC336D866DB51

Function 00F6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35fc6352e392bd2c9b4d410f0a9e760f592b6ad985b2c2e6050006d20daa12e4
Instruction ID: 7957b3cd129135eaffd745a473868fefcdf829f27badb93c39c0836813c833a4
Opcode Fuzzy Hash: 35fc6352e392bd2c9b4d410f0a9e760f592b6ad985b2c2e6050006d20daa12e4
Instruction Fuzzy Hash: 942183759093809FC702CF24D594715BF71EB46314F28C5EAD8498B2A7C33A980ACB62

Function 00F6EBCF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7db30da2bfdb9f1a9febcffb4be3f4d9242a8a5b28b617cf9223581590f01a
Instruction ID: f3c6748fc0be1a3f0f37140aa96f3bae9489484146dcb46ce6b1c7c7cb09abd5
Opcode Fuzzy Hash: cd7db30da2bfdb9f1a9febcffb4be3f4d9242a8a5b28b617cf9223581590f01a
Instruction Fuzzy Hash: 30219F76404240DFCF06CF54D9C4B56BF72FB88324F24C699ED090A25AC336D826DB91

Function 00F5D6AB Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b49ebb3647464524db950c25b84bc30cf7f483e8b35816b047356ddc5e1881
Instruction ID: 984a2d38aaffcd41f11a48003a334c36ce4e95595b6fe86ab6a1e85089db4473
Opcode Fuzzy Hash: f3b49ebb3647464524db950c25b84bc30cf7f483e8b35816b047356ddc5e1881
Instruction Fuzzy Hash: 0321AE76404280DFCB16CF10D9C4B16BF62FB88324F2486A9DD480A256C33AD81ADB92

Function 00F5D51F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction ID: a1a15fc42e9315727bc7de12bbee7d4fcdb835216fe923640550c42023900c46
Opcode Fuzzy Hash: 2a42a10f79047cfc5a8dfbea04f5877e4b045e58f4eb555799dbe40d0299e0d1
Instruction Fuzzy Hash: CB11E676904280CFCB16CF14D5C4B16BF71FB94324F28C5A9DD090B656C33AD85ADBA1

Function 00F6D31B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3315230266.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f6d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction ID: d8653ab2fda1586fc9e79bafacffdb04343bd3fa0f63d600b506555831e31d63
Opcode Fuzzy Hash: c74efafe6a787794d2e52374dfad20fc7a218ab120a23d42f416259975cce95d
Instruction Fuzzy Hash: F111BB75A04284CFCB02CF14D5C4B19BBB1FB84324F24C6AAD8494B796C33AD80ADB62

Function 00F5DACD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b826b7101e9f1e1828d4afe21843ae8aad86ac338234141e496a4f2dd81dab62
Instruction ID: d448617e78799e31aaf371e0936dabff47c7920eb9fdc0411174fcd4e6ef78b4
Opcode Fuzzy Hash: b826b7101e9f1e1828d4afe21843ae8aad86ac338234141e496a4f2dd81dab62
Instruction Fuzzy Hash: 44012B7250A304AAEB308A15CCC4767BF9CEF81335F18C559EE080A287C3789C44EAB1

Function 00F5D813 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dca272f746e9988cd4146baa3b77e5cbc45a7c15cc661cbfeb5664db5ad9fb5
Instruction ID: 5c7f973a6f6ba3294b6ec3cd64faf34667fbea0ee36009088af5dbda0fd6be86
Opcode Fuzzy Hash: 5dca272f746e9988cd4146baa3b77e5cbc45a7c15cc661cbfeb5664db5ad9fb5
Instruction Fuzzy Hash: 1601C876100A00AF97619F46D944C27FBBAFBC8720359855DE94A4BA22C372F851DFA0

Function 0C116E77 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ab34ac228ab6a2776154f21bc6428ddb96b4545d43ea78816f21f133761a9e
Instruction ID: bfb09a390c2db0bafbd609bb5a431250b2103d5b57361cee322ed9f67d2d31e7
Opcode Fuzzy Hash: 52ab34ac228ab6a2776154f21bc6428ddb96b4545d43ea78816f21f133761a9e
Instruction Fuzzy Hash: 5611D374A02209CFCB18DF6AC495AAEBBF1EF48211F1581ADE909E7361D7359940CB40

Function 0C116E78 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849ab4849d214016415d02cb9f7f78d5ed5037cd3f449008f5cb2b681eb7521c
Instruction ID: ad1b86599ba64354a9ad926ac363e5d8e2554b4f330a089912332093cf73b6cd
Opcode Fuzzy Hash: 849ab4849d214016415d02cb9f7f78d5ed5037cd3f449008f5cb2b681eb7521c
Instruction Fuzzy Hash: 3E11C974A02209CFDB58DF6AC455AAEBBF1FF48211F1581ADE909E7361D7359940CF80

Function 00F5D804 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8529044973b0ad733afb01380edc31e2c23d4fbb661c961e83ad607b689dae
Instruction ID: 24b4dba3632b4552bf407d598d6969622afa4111a184a2b6da0417fa46bc11d1
Opcode Fuzzy Hash: 2e8529044973b0ad733afb01380edc31e2c23d4fbb661c961e83ad607b689dae
Instruction Fuzzy Hash: 7901E976100640AFD7228F55C940C22BFBAFF897207198889E9964BA22C232F811DB60

Function 00F5D64F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b5e73348b01a90dfdc1cf125c2ea76a99a7f32065597d923748f797cb82c54
Instruction ID: 8cf4fb46ac54494dffebefb3e768a164352c1ef33d793f3eefdb7a2e6f4a8dcb
Opcode Fuzzy Hash: e7b5e73348b01a90dfdc1cf125c2ea76a99a7f32065597d923748f797cb82c54
Instruction Fuzzy Hash: 7CF0F4B6601604AF9720CF0AD884C27FBADEBC4770719C59AED5A4B712C671FC42DAA0

Function 00F5DACC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac7665b9595b537a9f4cb3148d861a041ddf0e59f72078dd55c4aa20b8ac2cf
Instruction ID: 97ec5c54f5dabb3b54c83ee98df55e0752d97c8b6cd8fb671016245c1d5f3cc0
Opcode Fuzzy Hash: cac7665b9595b537a9f4cb3148d861a041ddf0e59f72078dd55c4aa20b8ac2cf
Instruction Fuzzy Hash: EFF0C272405344AAEB208A05C9C4B62FF98EB91335F18C55AEE080A286C3789844DAB0

Function 00F5D640 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3314946163.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_f5d000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b6e186e0125ea2dd74e03cf085fdfb934fc93c9683c56ba847c49a89751925
Instruction ID: dd8ebb82317c6c6c6cf7e36515e64df0859963fc30dcccaa9c749897622e96fb
Opcode Fuzzy Hash: 03b6e186e0125ea2dd74e03cf085fdfb934fc93c9683c56ba847c49a89751925
Instruction Fuzzy Hash: 1DF03775105780AFD725CF06C884C22BBF9EFCA7607198489E85A8B362C631FC42DBA0

Function 0C115E9C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22de53583d79dbef0d24ef6b70e13429a7549d863b6f0d64731235e3d0ddb64f
Instruction ID: 2604cf7cb171c7dad4616b2de8ccfd77d562a599f116f07cd963f4335bfc0060
Opcode Fuzzy Hash: 22de53583d79dbef0d24ef6b70e13429a7549d863b6f0d64731235e3d0ddb64f
Instruction Fuzzy Hash: 6BE09AB2341625578A209A4EFA80927B3AAEFC43B13054636EE0DD37408B26FC41C6E2

Function 0C116BF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20409fab56e3667b9a0d3d51c97dfac9c9699cbcf648e9d0140acf2b9b1a79ca
Instruction ID: 9bd03df50a1325280a52b4e9f665acf7f29bcd11f3770a3f65df0fc40f2f31fd
Opcode Fuzzy Hash: 20409fab56e3667b9a0d3d51c97dfac9c9699cbcf648e9d0140acf2b9b1a79ca
Instruction Fuzzy Hash: 55F0DAB0D05B058FD768DF6AC50436BBAF1EF48200F108A3DD44AD2651E77956058BD1

Function 0C116F09 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792a3e8a0ce59927dab44e4bb932af6aa9387c830f307ee24712bc3da56c4635
Instruction ID: 18f4053808bf6d37b5d759d5a591a61dcccc0bc250ea3beec47014e478f7f636
Opcode Fuzzy Hash: 792a3e8a0ce59927dab44e4bb932af6aa9387c830f307ee24712bc3da56c4635
Instruction Fuzzy Hash: 1FF08C7092520BCFDB10DFB8C4256A9BFF0EB08304F1485B9D415E7241D7790605CF41

Function 0C116F18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.3411349331.000000000C110000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c110000_FastestVPN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd0f358f9e85f18c44a78d649b0d4b38a1ff6c9dc10a609778d904a8114eb25
Instruction ID: 4c5838e0a46f7224e69d435296059f67e6b55af67e8e402a9586b7254b68185b
Opcode Fuzzy Hash: 7dd0f358f9e85f18c44a78d649b0d4b38a1ff6c9dc10a609778d904a8114eb25
Instruction Fuzzy Hash: C1E0E5B095520A9FD754AFA8C5253AA7BF0AB04204F2088B9E419E6241E7794606CF91

Analysis Process: nfregdrv.exePID: 6676, Parent PID: 3348COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 100134A0 Relevance: 15.1, APIs: 10, Instructions: 58
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100134BE
OpenServiceA.ADVAPI32(00000000,?,00010000), ref: 100134D1
DeleteService.ADVAPI32(00000000), ref: 100134DE
GetLastError.KERNEL32 ref: 100134E4
CloseServiceHandle.ADVAPI32(00000000), ref: 100134ED
CloseServiceHandle.ADVAPI32(00000000), ref: 100134F6
GetLastError.KERNEL32 ref: 100134FE
CloseServiceHandle.ADVAPI32(00000000), ref: 10013507
GetLastError.KERNEL32 ref: 1001350F
SetLastError.KERNEL32(00000000), ref: 10013518

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandle$Open$DeleteManager
String ID:
API String ID: 2479149357-0
Opcode ID: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
Instruction ID: 46c2e6c5a61eedaf3fef038684788d392a8c372027cf2a0885eba6b60b5d160f
Opcode Fuzzy Hash: 0b951e9cdb1a0b26f3be69c1878f1c2782ce42dc9d03292b26ecafa066a6cc1a
Instruction Fuzzy Hash: 9F01F132641624AFE7126BF49C8DB5E3B68EF49F42F058130FB01DA161DAB1E84086B1

Function 10012F40 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snprintf.LIBCMT ref: 10012F6E
RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89
RegQueryValueExA.ADVAPI32(?,Tag,00000000,?,00000001,?), ref: 10012FD4
RegCloseKey.ADVAPI32(?), ref: 10012FFA

Strings

Tag, xrefs: 10012FE7
Tag, xrefs: 10012FC6
SYSTEM\CurrentControlSet\Services\%s, xrefs: 10012F5D

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpenQueryValue__snprintf
String ID: SYSTEM\CurrentControlSet\Services\%s$Tag$Tag
API String ID: 906094135-167878906
Opcode ID: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
Instruction ID: f9c08eb89e650521aaf22d2235fa5d9325a6f599f2f4c571dbf36a9dd9bf478e
Opcode Fuzzy Hash: 6f56ef87285fea69d5a8c9f690d12e05e358ab22d85251f7a7e5ed3c1616b0d0
Instruction Fuzzy Hash: 33116DB1A04354AFE328CB64CC4AFEB77E8EB89B40F40481CB74D9A180E774D945C7A2

Function 10012D70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86
RegQueryValueExA.KERNELBASE ref: 10012DB9
RegSetValueExA.KERNELBASE(?,DisabledComponents,00000000,00000004,?,00000004,?), ref: 10012DF7
RegCloseKey.KERNELBASE(?), ref: 10012E04

Strings

SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters, xrefs: 10012D7C
DisabledComponents, xrefs: 10012DF1
DisabledComponents, xrefs: 10012DAB

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$CloseOpenQuery
String ID: DisabledComponents$DisabledComponents$SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters
API String ID: 237177642-4216016250
Opcode ID: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
Instruction ID: 9ee4d2c3e57a7063b565cc8fc060191f73725880ea3dbb34ca1c1c45c67cef35
Opcode Fuzzy Hash: e76360cbcc9baf098a5e93c68d2a24a7b395f91ed9355a7129efde6212d0d687
Instruction Fuzzy Hash: 7911A0B5508312BFE710DB54DD44FAB7BE8EB88B44F41890CF6899A0D0E374C984C756

Function 10012D00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15
RegSetValueExA.KERNELBASE(00000000,DisableTaskOffload,00000000,00000004,?,00000004,?), ref: 10012D47
RegCloseKey.ADVAPI32(?), ref: 10012D54

Strings

DisableTaskOffload, xrefs: 10012D3D
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, xrefs: 10012D0B

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpenValue
String ID: DisableTaskOffload$SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
API String ID: 779948276-1474643600
Opcode ID: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
Instruction ID: 2230c34db065372bc40d34239641de211e9b25fb5ab268f73dea6e655c247ba9
Opcode Fuzzy Hash: b914e9072d492bfd31763df8d8490f62f2f2385f3a95968ca031b7c0720cf9be
Instruction Fuzzy Hash: BBF0E9716043207FE711EB209C4AF5B37E8AB8CB00F84891CF794DA180E370C958C796

Function 00401000 Relevance: 3.8, APIs: 3, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32 ref: 0040102B
CharNextA.USER32 ref: 00401032
CharNextA.USER32 ref: 00401040

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
Instruction ID: dde81b71a90f9f684eae9ae77c255fe350d7d91c01edff3817fbd5cfc17a4160
Opcode Fuzzy Hash: 7c522331cf8c48b44b5ec6a2051b80fc459d173407debce357d97d96f401c9b2
Instruction Fuzzy Hash: 3BE06522A056E216D732162D28107AB568C4FD57E071A457BE8C0F77A5D639CCC642DD

Function 0040285E Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00401236,00000001), ref: 0040286F
HeapDestroy.KERNEL32 ref: 004028A5

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
Instruction ID: c9b1d8ae43914fce643a3b0feff7cc958f3d34f8e715b1d91c1e9ab3a3c39313
Opcode Fuzzy Hash: 6a61f211992a6e18c95607d49fad3f3b072efb0b2f059ec0a30deba2ad50305b
Instruction Fuzzy Hash: ABE06576550301DAEB457B715F0DB363594E74074AF10853BF841F51E2FBB88540960D

Function 100092CF Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,10008AA9,00000001,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C), ref: 100092E0
HeapDestroy.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 10009316

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
Instruction ID: 0c4cb1e0f78fd55b04bfad504b74cc3b14dfc1a1f94936553e122905dbeb7e21
Opcode Fuzzy Hash: 564c51fca60af66e7a4a00761b05f1ec1e784a5b92eab29dc0ead7a71cea7728
Instruction Fuzzy Hash: 3CE01279654362AEFB41DB308C8976A35E8E7547C6F10C939F415C50B8FBB0C6809A04

Function 004014E3 Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 004014E7

Part of subcall function 004014BD: GetModuleHandleA.KERNEL32(mscoree.dll,004014EC,?,00405D96,000000FF,0000001E,00000001,00000000,00000000,?,004040D4,?,00000001,?,00402C9C,00000018), ref: 004014C2
Part of subcall function 004014BD: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004014D2

ExitProcess.KERNEL32 ref: 004014F1

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
Instruction ID: 537dee8b853bd8b800ce6c4827e120e5e31ff7b11606db799f1f5586ed61abf1
Opcode Fuzzy Hash: 6c26d35538560624cb0276524913e3c26102e8c22ac44d2ad5d5b3d3ea4d6717
Instruction Fuzzy Hash: EBB01230004100AFC6012B10EF0BC0D7B71EF40744F00C47DF088100708F354C54BE05

Non-executed Functions

Function 10013540 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100135C3
CreateServiceW.ADVAPI32(00000000,?,?,000F01FF,00000001,00000001,00000001,?,PNP_TDI,?,00000000,00000000,00000000), ref: 10013605
CloseServiceHandle.ADVAPI32(00000000), ref: 1001361B
GetLastError.KERNEL32 ref: 10013625
GetLastError.KERNEL32 ref: 1001363D
OpenServiceA.ADVAPI32(?,?,00000014), ref: 10013655
QueryServiceStatus.ADVAPI32(00000000,?), ref: 10013667
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 1001367D
GetLastError.KERNEL32 ref: 10013689
CloseServiceHandle.ADVAPI32(00000000), ref: 10013692
CloseServiceHandle.ADVAPI32(?), ref: 100136A7
SetLastError.KERNEL32(00000000), ref: 100136B9

Strings

PNP_TDI, xrefs: 100135E4
system32\drivers\%S.sys, xrefs: 100135A3
%S\%S.sys, xrefs: 1001358A

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandle$Open$CreateManagerQueryStartStatus
String ID: %S\%S.sys$PNP_TDI$system32\drivers\%S.sys
API String ID: 3292902256-1894622794
Opcode ID: 660a23612fc86a23e892aea1473c593627136715394c5b516177490ee6cba120
Instruction ID: 3a4aafa71a6d85f3e9df812c39c39bfa152d82fe410905c2edde1af795798740
Opcode Fuzzy Hash: 660a23612fc86a23e892aea1473c593627136715394c5b516177490ee6cba120
Instruction Fuzzy Hash: 1841E172644310BFE321DB608C89FAB77E9EB89B40F01851CFB859B291DA71E9408766

Function 10002060 Relevance: 19.9, APIs: 13, Instructions: 395COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 100020EF
__aullrem.LIBCMT ref: 10002114
GetTickCount.KERNEL32 ref: 1000215A
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002199
EnterCriticalSection.KERNEL32(1002030C), ref: 100021AE
GetTickCount.KERNEL32 ref: 10002256
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002295
EnterCriticalSection.KERNEL32(1002030C), ref: 100022AA
EnterCriticalSection.KERNEL32 ref: 1000239F
EnterCriticalSection.KERNEL32(?), ref: 100023FE
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002498
EnterCriticalSection.KERNEL32(1002030C), ref: 100024AD
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002563

Part of subcall function 10014ED0: EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
Part of subcall function 10014ED0: WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
Part of subcall function 10014ED0: GetLastError.KERNEL32 ref: 10014F99
Part of subcall function 10014ED0: LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$CountTick$ErrorFileLastWrite__aullrem
String ID:
API String ID: 2584342812-0
Opcode ID: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
Instruction ID: 27e7611ef1cc4cd64037de96806a1b775dfd5a4704548cb2295c2b271f4c6af1
Opcode Fuzzy Hash: af9e0746b45dabf02fd2421baf30e015d80efef54aadf8bda24db42c6145cc84
Instruction Fuzzy Hash: F8F19A74604742EFE310CF64C984A4AB7F6FF48784F418929E9499BA15E330FD95CBA2

Function 100139D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 100139D4
OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 100139E2
OpenProcessToken.ADVAPI32(00000000,00000020,?), ref: 100139F7
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10013A13
CloseHandle.KERNEL32(?), ref: 10013A22
CloseHandle.KERNEL32(00000000), ref: 10013A25
AdjustTokenPrivileges.ADVAPI32 ref: 10013A5F
CloseHandle.KERNEL32(?), ref: 10013A74
CloseHandle.KERNEL32(00000000), ref: 10013A77

Strings

SeDebugPrivilege, xrefs: 10013A0C

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$Process$OpenToken$AdjustCurrentLookupPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2638893802-2896544425
Opcode ID: 419289fe1aa8360b2f1914424ecfbc0142881d51788569709d273a4057b6a3c7
Instruction ID: 0388be8fc12d26e35ffcfca9aa46a7d98fc754c634c7c292c2151c31a72acd32
Opcode Fuzzy Hash: 419289fe1aa8360b2f1914424ecfbc0142881d51788569709d273a4057b6a3c7
Instruction Fuzzy Hash: 58116A75604310AFE201EB68CC89FAF7BE8EFC8754F44841CFA8896291D770E5448BA6

Function 100163B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,6E39044B,?,?,?,00000000), ref: 1001640D
QueryDosDeviceW.KERNEL32 ref: 1001646C
GetDriveTypeW.KERNEL32(?,?,?,?,?,?), ref: 100165A1
EnterCriticalSection.KERNEL32(10020484), ref: 10016726
LeaveCriticalSection.KERNEL32(10020484), ref: 10016742

Strings

:, xrefs: 1001645A

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalDriveSection$DeviceEnterLeaveLogicalQueryStringsType
String ID: :
API String ID: 3137785116-336475711
Opcode ID: 309e0b93bcea4dd87cd4e26c409c77e7e666b1aaa0db519f1e08522f54eca9c8
Instruction ID: 05aef7f753930580f9efe3ccf0e9bc9ed64d96a84334a073f7ef42401ff9f03d
Opcode Fuzzy Hash: 309e0b93bcea4dd87cd4e26c409c77e7e666b1aaa0db519f1e08522f54eca9c8
Instruction Fuzzy Hash: ADA15AB15083818BE720CF64CC85B9BB7E5FF88344F448A1EE6898B251D770E688CB53

Function 00401050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401000: CharNextA.USER32 ref: 0040102B
Part of subcall function 00401000: CharNextA.USER32 ref: 00401032

MessageBoxA.USER32(00000000,Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys,nfregdvr,00000000), ref: 004010AE
?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010CA
?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z.NFAPI(?), ref: 004010DB

Strings

Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys, xrefs: 004010A7
nfregdvr, xrefs: 004010A2

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: CharDriver@nfapi@@Next$?nf_register?nf_unMessageRegister
String ID: Usage: nfregdrv.exe <driver_name> - register windows\system32\drivers\<driver_name>.sys nfregdrv.exe -u <driver_name> - unregister windows\system32\drivers\<driver_name>.sys$nfregdvr
API String ID: 1889258244-2180452595
Opcode ID: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
Instruction ID: 1ab8e34958d480acc8493b27089cbdf5696b9cf7d697ab9778d1d713517b65dd
Opcode Fuzzy Hash: 3a882d4fb6fe95bf0d5de4b4e3cf2f64ab34e96ef2f70e27ee227c43f8033b4f
Instruction Fuzzy Hash: 8F01DE705082806AE70163746E057877A806F55755F08C87BF9D4B63E2E6B88898C7BF

Function 100141E0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100141E6
LeaveCriticalSection.KERNEL32(1002030C), ref: 100141FA
DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000024A,00000000,00000000,?,00000000), ref: 10014287
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014297

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: c1d6194b3b625dbf574e7b20ed250350b817444bdaab0ad358dee30cb838081e
Instruction ID: 85bbbeb16c55dea885b82d2df4faedcc8aa5688a631ff53f8ce63f3f1ec5c482
Opcode Fuzzy Hash: c1d6194b3b625dbf574e7b20ed250350b817444bdaab0ad358dee30cb838081e
Instruction Fuzzy Hash: 17110A76510210AFE700CB68DC89E9633E9EF89761F51C215F6168F1E5EF70EAC4C6A1

Function 10007CCF Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000A7F0
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000A805
UnhandledExceptionFilter.KERNEL32(100198DC), ref: 1000A810
GetCurrentProcess.KERNEL32(C0000409), ref: 1000A82C
TerminateProcess.KERNEL32(00000000), ref: 1000A833

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 06ef2c53437fd46401bc4568d3fe183aff5b9b3a6a8811e184a836bfc1ef5544
Instruction ID: 5cd202c4d6932f10897f274e1b34921bd933b478cb37430cfba53272a53993d9
Opcode Fuzzy Hash: 06ef2c53437fd46401bc4568d3fe183aff5b9b3a6a8811e184a836bfc1ef5544
Instruction Fuzzy Hash: 9E21AEB89083259FF701DF94DCC46647BE4FB28754F40D15EE508872A5E7B0D9808F45

Function 10014000 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10014010
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014025
DeviceIoControl.KERNEL32(FFFFFFFF,0022019C,00000000,00000000,00000000,00000004,00000000,00000000), ref: 10014049
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001405F

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
Instruction ID: 194b0543918d9f7547c24edad603a73f0d8bc4c4cca9a48bf73c364b07b3f58e
Opcode Fuzzy Hash: 4981ae034996778ee2c8bf16bcf631c7842ba69716a9c5caf53513e94cd4e299
Instruction Fuzzy Hash: E8F09674A10310AFF701EB60ED89B8937A6EB98F12FC2C514F7098A1E1D7B5D95CC662

Function 10014170 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014176
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001418B
DeviceIoControl.KERNEL32(FFFFFFFF,002201D0,00000000,00000000,00000000,00000000,?,00000000), ref: 100141AD
LeaveCriticalSection.KERNEL32(1002030C), ref: 100141BC

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: ed04f4c91301ef5749866e6216c76f80c91ee0689320974670393c5e7210247c
Instruction ID: ea0cb0fdb19bb7dbbc03564ec765e3cd75472be6806d2b7526bfc3e15de05ea0
Opcode Fuzzy Hash: ed04f4c91301ef5749866e6216c76f80c91ee0689320974670393c5e7210247c
Instruction Fuzzy Hash: 83F03974261310BFF205D7749D8AF5533A9EF18B32F628708F62AD90E1DF70E8449A51

Function 100013F0 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 100013FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 10001411

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: EventInfoResetSystem
String ID:
API String ID: 3761259369-0
Opcode ID: 508fc2042419c3a36b202234b76a069f5d08a4c1d9f6591d6dd30bc335c3ad5d
Instruction ID: 39d4c7a7ad4dc565fb3197904db44af1b56c26df66e8bdcd4ed7d8d6cef16289
Opcode Fuzzy Hash: 508fc2042419c3a36b202234b76a069f5d08a4c1d9f6591d6dd30bc335c3ad5d
Instruction Fuzzy Hash: DE210172A002119BE320CE14CD40F9B73EAEFC4790F0A891CED5A9B268EA71FD4487D1

Function 004017B5 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 00401821
__invoke_watson.LIBCMT ref: 00401832
GetModuleFileNameA.KERNEL32(00000000,0040B059,00000104), ref: 0040184E
_strcpy_s.LIBCMT ref: 00401863
__invoke_watson.LIBCMT ref: 00401876
_strlen.LIBCMT ref: 0040187F
_strlen.LIBCMT ref: 0040188C
__invoke_watson.LIBCMT ref: 004018B9
_strcat_s.LIBCMT ref: 004018CC
__invoke_watson.LIBCMT ref: 004018DD
_strcat_s.LIBCMT ref: 004018EE
__invoke_watson.LIBCMT ref: 004018FF
GetStdHandle.KERNEL32(000000F4,?,?,00000000,76EC5E70,00000003,00401981,000000FC,00405D85,00000001,00000000,00000000,?,004040D4,?,00000001), ref: 0040191E
_strlen.LIBCMT ref: 0040193F
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,004040D4,?,00000001,?,00402C9C,00000018,004094A0,0000000C,00402D2B,?), ref: 00401949

Strings

..., xrefs: 0040189D
Microsoft Visual C++ Runtime Library, xrefs: 0040190C
Runtime Error!Program: , xrefs: 00401810
<program name unknown>, xrefs: 00401858

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
Instruction ID: ac205ba077d332f24294b0c45a0e422cb4ceea3e0f9d8061dc6338a319882752
Opcode Fuzzy Hash: 38520d41a68f396a59cc94f311c6a7ce392be311100e9e9c31ac4f97fc74b26a
Instruction Fuzzy Hash: 043126E26402057AE6213A265E4AF2F3A4C9B01755F14403BFD45B22F3FA7E9A1181FE

Function 1000A532 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 1000A59E
__invoke_watson.LIBCMT ref: 1000A5AF
GetModuleFileNameA.KERNEL32(00000000,1001F3C9,00000104), ref: 1000A5CB
_strcpy_s.LIBCMT ref: 1000A5E0
__invoke_watson.LIBCMT ref: 1000A5F3
_strlen.LIBCMT ref: 1000A5FC
_strlen.LIBCMT ref: 1000A609
__invoke_watson.LIBCMT ref: 1000A636
_strcat_s.LIBCMT ref: 1000A649
__invoke_watson.LIBCMT ref: 1000A65A
_strcat_s.LIBCMT ref: 1000A66B
__invoke_watson.LIBCMT ref: 1000A67C
GetStdHandle.KERNEL32(000000F4,00000001,00000001,00000000,76EC5E70,00000003,1000A6FE,000000FC,10007C34,00000001,00000000,00000000,?,1000B162,?,00000001), ref: 1000A69B
_strlen.LIBCMT ref: 1000A6BC
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,1000B162,?,00000001,00000001,1000949D,00000018,1001B628,0000000C,1000952C,00000001), ref: 1000A6C6

Strings

Microsoft Visual C++ Runtime Library, xrefs: 1000A689
..., xrefs: 1000A61A
<program name unknown>, xrefs: 1000A5D5
Runtime Error!Program: , xrefs: 1000A58D

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 4af349e1e8f6137c98c74494d34e3a9ba254edd55f11037dcb0b6f13b7d5c0d9
Instruction ID: ea148cf6e80d7e79cea2e11fe5e00895b7d8e29f61cf08ee7211173885be836a
Opcode Fuzzy Hash: 4af349e1e8f6137c98c74494d34e3a9ba254edd55f11037dcb0b6f13b7d5c0d9
Instruction Fuzzy Hash: E83118B69001252AF600E6208C56F7F369CEF172D0F050225FD49A519BEF37EEC241B6

Function 0040267F Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,00401248), ref: 00402685
__mtterm.LIBCMT ref: 00402691

Part of subcall function 004023D3: TlsFree.KERNEL32(00000003,004027FE), ref: 004023FE
Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000000,00000000,7591DFB0,00000001,004027FE), ref: 00402C00
Part of subcall function 004023D3: DeleteCriticalSection.KERNEL32(00000003,7591DFB0,00000001,004027FE), ref: 00402C2A

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004026A7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004026B4
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004026C1
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004026CE
TlsAlloc.KERNEL32 ref: 0040271E
TlsSetValue.KERNEL32(00000000), ref: 00402739
__init_pointers.LIBCMT ref: 00402743
__calloc_crt.LIBCMT ref: 004027B8
GetCurrentThreadId.KERNEL32 ref: 004027E8

Strings

KERNEL32.DLL, xrefs: 00402680
FlsSetValue, xrefs: 004026B6
FlsFree, xrefs: 004026C3
FlsGetValue, xrefs: 004026A9
FlsAlloc, xrefs: 004026A1

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2125014093-3819984048
Opcode ID: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
Instruction ID: cf69b49cc4cf955eeb84bbbee0c69ed19c09a43a9505152bb4945c0e988a6b5c
Opcode Fuzzy Hash: 566b6117ed883b32ce1da04161b31b8634341426bd229c3b9e021c861b04e7bb
Instruction Fuzzy Hash: EF313931900311DADB51AB75AF49A063BA4EB44354B10053FE994B72F2DFB98540DF9E

Function 1000AD10 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,10008AB7,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000AD16
__mtterm.LIBCMT ref: 1000AD22

Part of subcall function 1000A9FB: TlsFree.KERNEL32(00000001,10008B53,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000AA26

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1000AD38
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1000AD45
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1000AD52
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1000AD5F
TlsAlloc.KERNEL32(?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000ADAF
TlsSetValue.KERNEL32(00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608,0000000C,10008CE1,?), ref: 1000ADCA
__init_pointers.LIBCMT ref: 1000ADD4
__calloc_crt.LIBCMT ref: 1000AE49
GetCurrentThreadId.KERNEL32 ref: 1000AE79

Strings

FlsGetValue, xrefs: 1000AD3A
FlsAlloc, xrefs: 1000AD32
FlsSetValue, xrefs: 1000AD47
KERNEL32.DLL, xrefs: 1000AD11
FlsFree, xrefs: 1000AD54

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 630932248-3819984048
Opcode ID: 27197f949f2674e2884e29655a0beec5e1f2c8da553a5096224482f203d367b5
Instruction ID: 1b7aacb4b742e95e3da3d0493d0b543e31d3ba40a5e9cc7053759451afc8b022
Opcode Fuzzy Hash: 27197f949f2674e2884e29655a0beec5e1f2c8da553a5096224482f203d367b5
Instruction Fuzzy Hash: D5317EB1801262AAFB10EF78CC85A253FA4EB622D0B22C72EF425C71A4DF35C4C0CB51

Function 10017590 Relevance: 28.7, APIs: 19, Instructions: 204filesynchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(FFFFFFFF), ref: 100175B7

Part of subcall function 100013F0: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 100013FC
Part of subcall function 100013F0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,100175DD,10020370), ref: 10001411

EnterCriticalSection.KERNEL32(100203D8,100203F0,10020370), ref: 10017613
LeaveCriticalSection.KERNEL32(100203D8), ref: 10017621
ReadFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10017661
GetLastError.KERNEL32 ref: 1001766B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,0000000A), ref: 1001768B
EnterCriticalSection.KERNEL32(100203D8), ref: 100176B7
LeaveCriticalSection.KERNEL32(100203D8), ref: 100176C4
SetEvent.KERNEL32(?), ref: 100176D9
SetEvent.KERNEL32(?), ref: 100176ED
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00001388), ref: 10017700
WaitForSingleObject.KERNEL32(FFFFFFFF,00000000), ref: 10017719
GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000000), ref: 10017739
EnterCriticalSection.KERNEL32(100203D8), ref: 100177F0
LeaveCriticalSection.KERNEL32(100203D8), ref: 100177FD
SetEvent.KERNEL32(?), ref: 10017812
SetEvent.KERNEL32(?), ref: 10017826
CancelIo.KERNEL32(FFFFFFFF), ref: 10017847
SetEvent.KERNEL32(FFFFFFFF), ref: 10017868

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Event$CriticalSection$EnterLeaveWait$MultipleObjects$CancelErrorFileInfoLastObjectOverlappedReadResetResultSingleSystem
String ID:
API String ID: 2252100280-0
Opcode ID: e910f63d7a54be93efb29594c5c449f4169a1d0cc538782f8b68b19805b9bf9f
Instruction ID: f695dd025300f569b5dc1954a0fe927f0ea0d4c7cb43f690e196a72113c686ee
Opcode Fuzzy Hash: e910f63d7a54be93efb29594c5c449f4169a1d0cc538782f8b68b19805b9bf9f
Instruction Fuzzy Hash: 147180719093A19FE341DB64CCC4A5E7BFAFB88344F51881DF549CB262D630E945CB52

Function 10013790 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 156fileCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 100137C7
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,00000000), ref: 100137EF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100137F9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,00000000), ref: 10013846
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 1001384A
_memset.LIBCMT ref: 1001386F
GetVersionExA.KERNEL32 ref: 10013884
DeviceIoControl.KERNEL32(00000000,0022019C,00000000,00000000,?,00000004,?,00000000), ref: 100138A8
SetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 10013975

Part of subcall function 10013540: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 100135C3

Strings

aswstm, xrefs: 10013955
\\.\CtrlSM, xrefs: 100137A8
aswstm, xrefs: 100138B8
symnets, xrefs: 10013914
nisdrv, xrefs: 100138EE
360netmon, xrefs: 10013903
%s%s, xrefs: 100137AD

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: ErrorLast$CreateFile$ControlDeviceManagerOpenVersion__snprintf_memset
String ID: %s%s$360netmon$\\.\CtrlSM$aswstm$aswstm$nisdrv$symnets
API String ID: 3009835240-779568551
Opcode ID: a3a7f9f4621a4370de1945aa5ff1c6f54205322984f1227c5b51e51712c71830
Instruction ID: baa3f68826ae7ef6a95450bd968b4d24564606f9d9b479f6fa913fa53dd98394
Opcode Fuzzy Hash: a3a7f9f4621a4370de1945aa5ff1c6f54205322984f1227c5b51e51712c71830
Instruction Fuzzy Hash: B641F6F5904341ABE610DB649C82F9B77E8EB81758F00852DF6456A1C2EB71E9C8C763

Function 10012E20 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?,?,00000001,?,?,00000000), ref: 10012E39
RegQueryValueExA.ADVAPI32(?,PNP_TDI,00000000,?,00000000,?,00000000), ref: 10012E70
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000001), ref: 10012E7B

Strings

PNP_TDI, xrefs: 10012F12
SYSTEM\CurrentControlSet\Control\GroupOrderList, xrefs: 10012E2F
PNP_TDI, xrefs: 10012E6A
PNP_TDI, xrefs: 10012EBD

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: PNP_TDI$PNP_TDI$PNP_TDI$SYSTEM\CurrentControlSet\Control\GroupOrderList
API String ID: 3677997916-2641009432
Opcode ID: 2eb10eaa1c7938493b03d9852b263a48069f7a2f456ef6b17a8b5cbc44dafcf6
Instruction ID: adba37e169228668f0a2802fe9bc245960bfac646b6212eb4cbe9f041a721e83
Opcode Fuzzy Hash: 2eb10eaa1c7938493b03d9852b263a48069f7a2f456ef6b17a8b5cbc44dafcf6
Instruction Fuzzy Hash: 6531A1B6500311ABE711DB64EC86FDB77E8EF48641F504428F649D7240E730E854C7A1

Function 10013020 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 88registryCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 10013094
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000003,?,?,?,?,?), ref: 100130AF
RegSetValueExA.ADVAPI32(?,Group,00000000,00000001,?,00000005), ref: 100130F6
RegSetValueExA.ADVAPI32(?,DependOnService,00000000,00000007,?,00000007), ref: 1001310D
RegCloseKey.ADVAPI32(?), ref: 10013133

Strings

PNP_TDI, xrefs: 10013063
NDIS, xrefs: 1001303A
SYSTEM\CurrentControlSet\Services\%s, xrefs: 10013073
tcpip, xrefs: 10013057
DependOnService, xrefs: 10013107
Group, xrefs: 10013120
Group, xrefs: 100130F0

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$CloseOpen__snprintf
String ID: DependOnService$Group$Group$NDIS$PNP_TDI$SYSTEM\CurrentControlSet\Services\%s$tcpip
API String ID: 1654562893-4206996638
Opcode ID: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
Instruction ID: f39133bfa4f10865251ae0e01663f88c1eeb0859d6cfe85fe8bdc8d9a42c57b8
Opcode Fuzzy Hash: 8e36c738326b6755c6e6de9151109be2b92cdf69e4b2cd075e3ef94430a67263
Instruction Fuzzy Hash: AF316675618350AFE715CB64CC91FAB77E5AB8D710F40C80CF68897290EA74E984CBD2

Function 00403474 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004034A1
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004034BD

Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
Part of subcall function 004022B3: TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7

GetProcAddress.KERNEL32(00000000,00000000), ref: 004034DA

Part of subcall function 004022B3: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
Part of subcall function 004022B3: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307

GetProcAddress.KERNEL32(00000000,00000000), ref: 004034EF
__invoke_watson.LIBCMT ref: 00403510

Part of subcall function 00402D4D: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 00402DF7
Part of subcall function 00402D4D: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 00402E01
Part of subcall function 00402D4D: UnhandledExceptionFilter.KERNEL32(0040B040,?,?,00000000), ref: 00402E0B
Part of subcall function 00402D4D: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00402E26
Part of subcall function 00402D4D: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 00402E2D

Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E

Part of subcall function 0040232A: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
Part of subcall function 0040232A: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 00403524
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0040353C
__invoke_watson.LIBCMT ref: 004035AF

Strings

MessageBoxA, xrefs: 004034B7
GetProcessWindowStation, xrefs: 00403536
USER32.DLL, xrefs: 0040349C
GetUserObjectInformationA, xrefs: 0040351E

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2691309996-1046234306
Opcode ID: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
Instruction ID: 13767e751e4e8118919b7ef88e5ef330d54a0fa0e132c7187f46cb55eadbc1d1
Opcode Fuzzy Hash: f1db5f22bdf6dbb55a5fef3c5404ea4e20a60e7af2fc674b508acf6c650a639d
Instruction Fuzzy Hash: FC416271D04205BACF21AFE59E8596F7FACEB44356B14487FE401F22D0DBBD8A408A9D

Function 1000EA12 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000EA3F
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 1000EA5B

Part of subcall function 1000A8A7: TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
Part of subcall function 1000A8A7: TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB

GetProcAddress.KERNEL32(00000000,00000000), ref: 1000EA78

Part of subcall function 1000A8A7: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
Part of subcall function 1000A8A7: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB

GetProcAddress.KERNEL32(00000000,00000000), ref: 1000EA8D
__invoke_watson.LIBCMT ref: 1000EAAE

Part of subcall function 100081EF: _memset.LIBCMT ref: 1000827B
Part of subcall function 100081EF: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 10008299
Part of subcall function 100081EF: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 100082A3
Part of subcall function 100081EF: UnhandledExceptionFilter.KERNEL32(1001F3B0,?,?,00000000), ref: 100082AD
Part of subcall function 100081EF: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 100082C8
Part of subcall function 100081EF: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 100082CF

Part of subcall function 1000A91E: TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
Part of subcall function 1000A91E: TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942

Part of subcall function 1000A91E: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
Part of subcall function 1000A91E: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 1000EAC2
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 1000EADA
__invoke_watson.LIBCMT ref: 1000EB4D

Strings

MessageBoxA, xrefs: 1000EA55
USER32.DLL, xrefs: 1000EA3A
GetUserObjectInformationA, xrefs: 1000EABC
GetProcessWindowStation, xrefs: 1000EAD4

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: d07f4621edcdfa6a2460bf8fc81f84a922532c73ec9128826bd03ea427b93a6a
Instruction ID: 9cd623b29455d8c5ce966f6a502c8aefc0998dc8575b976e3ae0cba05518725e
Opcode Fuzzy Hash: d07f4621edcdfa6a2460bf8fc81f84a922532c73ec9128826bd03ea427b93a6a
Instruction Fuzzy Hash: 0D418C75D04299AAFF04EFA4CCC596E7BE9EF153C0B11452EE402F2155DB38EA848B62

Function 10017AB0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10017AF0
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017CE3

Part of subcall function 10012D70: RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters,00000000,00000003,?,?,?,10013525,00000000), ref: 10012D86

Part of subcall function 10012D00: RegOpenKeyExA.KERNELBASE(80000002,SYSTEM\CurrentControlSet\Services\Tcpip\Parameters,00000000,00000002,00000000,00000000,00000000), ref: 10012D15

Part of subcall function 10013790: __snprintf.LIBCMT ref: 100137C7
Part of subcall function 10013790: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,00000000), ref: 100137EF
Part of subcall function 10013790: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 100137F9
Part of subcall function 10013790: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,40000000,00000000,?,?,?,?,?,00000000), ref: 10013846
Part of subcall function 10013790: GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 1001384A
Part of subcall function 10013790: _memset.LIBCMT ref: 1001386F
Part of subcall function 10013790: GetVersionExA.KERNEL32 ref: 10013884
Part of subcall function 10013790: DeviceIoControl.KERNEL32(00000000,0022019C,00000000,00000000,?,00000004,?,00000000), ref: 100138A8

_strncpy.LIBCMT ref: 10017B59
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10017B93
DeviceIoControl.KERNEL32(FFFFFFFF,0012C800,00000000,00000000,10020180,00000020,00000000,?), ref: 10017BD9
GetLastError.KERNEL32 ref: 10017BE3
CloseHandle.KERNEL32(FFFFFFFF), ref: 10017C01
CloseHandle.KERNEL32(00000000), ref: 10017C13
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017C1A
GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000001), ref: 10017C48
?nf_free@nfapi@@YAXXZ.NFAPI ref: 10017CC2

Strings

, xrefs: 10017C52

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CreateCriticalErrorLastSection$CloseControlDeviceFileHandleLeaveOpen$?nf_free@nfapi@@EnterEventOverlappedResultVersion__snprintf_memset_strncpy
String ID:
API String ID: 2653159964-3916222277
Opcode ID: 3f87b7c55b4061039f33afb2760d837fa2a97d9a8f10da4fd9a74bcaa174a95a
Instruction ID: 607d77e5ab761dd3358ab37ac97749732553c8b829fe0467e4f2801d9018e119
Opcode Fuzzy Hash: 3f87b7c55b4061039f33afb2760d837fa2a97d9a8f10da4fd9a74bcaa174a95a
Instruction Fuzzy Hash: 3F51C0B08043549FE341CF38CCC565A7BE9FB08364F60462DF559DB2A2D735DA858B92

Function 10014CF0 Relevance: 18.2, APIs: 12, Instructions: 157fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020324), ref: 10014D6E
WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014DF8
GetLastError.KERNEL32 ref: 10014E02
LeaveCriticalSection.KERNEL32(10020324), ref: 10014E14

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterErrorFileLastLeaveWrite
String ID:
API String ID: 1726892732-0
Opcode ID: 9df71c563617eb9f339eaef5488ee90d51df01b4ebf1fcf1fc522e00c65f13bd
Instruction ID: e6d18f47d42f15309a32aad744ee6051ace0a6f11929ee79e8724ce5300da237
Opcode Fuzzy Hash: 9df71c563617eb9f339eaef5488ee90d51df01b4ebf1fcf1fc522e00c65f13bd
Instruction Fuzzy Hash: 14515971A043219FD304CF68EC84A66B7E9FB88720F118A5EF959CB2A1DB30D9458B91

Function 10014ED0 Relevance: 18.1, APIs: 12, Instructions: 116filesynchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020324,?,?,?,?,?,?,?,?,?,1001536D), ref: 10014F3F
WriteFile.KERNEL32(FFFFFFFF,?,00000008,00000000,?), ref: 10014F8F
GetLastError.KERNEL32 ref: 10014F99
LeaveCriticalSection.KERNEL32(10020324), ref: 10014FAB
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 10014FC6
CancelIo.KERNEL32(FFFFFFFF), ref: 10014FD7
LeaveCriticalSection.KERNEL32(10020324), ref: 10014FE2
WaitForSingleObject.KERNEL32(FFFFFFFF,00000000), ref: 10014FF9
CancelIo.KERNEL32(FFFFFFFF), ref: 10015009
LeaveCriticalSection.KERNEL32(10020324), ref: 10015014
GetOverlappedResult.KERNEL32(FFFFFFFF,?,?,00000000), ref: 1001502F
LeaveCriticalSection.KERNEL32(10020324), ref: 1001504B

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$CancelWait$EnterErrorFileLastMultipleObjectObjectsOverlappedResultSingleWrite
String ID:
API String ID: 875271372-0
Opcode ID: 4956b33f9505844bcca6f3e2d83279b108e1b3c573e129efff33a3fba19fd776
Instruction ID: 56031a59c6608db13f70e1c4f4aa1c6cc63b7cc0fadcfe5918aabc4c2d2b60d1
Opcode Fuzzy Hash: 4956b33f9505844bcca6f3e2d83279b108e1b3c573e129efff33a3fba19fd776
Instruction Fuzzy Hash: B3418E359043209FE305CF68CCC5A6A77E5FB88760F51CA1DF9A9CA2A1DB30D9458B92

Function 00402410 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
__lock.LIBCMT ref: 0040248F
___addlocaleref.LIBCMT ref: 004024AE

Strings

KERNEL32.DLL, xrefs: 0040241C
EncodePointer, xrefs: 00402447
DecodePointer, xrefs: 0040245D

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
Instruction ID: c1e121c7a9f45585e2cf3b5064cbb5a882fb755c8da4f7f00742ea9dc2ffa3f8
Opcode Fuzzy Hash: 492f236ed60c7165788bb238f70ef5b424b799d510fd4f5d693c5339c7311626
Instruction Fuzzy Hash: C41182719407019ED710AF75DA49B5ABBE4EF44314F10853EE495B32D1CBBC9900CF19

Function 1000AA38 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,1001B668,0000000C,1000AB49,00000000,00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000), ref: 1000AA49
GetProcAddress.KERNEL32(?,EncodePointer), ref: 1000AA7D
GetProcAddress.KERNEL32(?,DecodePointer), ref: 1000AA8D
InterlockedIncrement.KERNEL32(1001E5E0), ref: 1000AAAF
__lock.LIBCMT ref: 1000AAB7
___addlocaleref.LIBCMT ref: 1000AAD6

Strings

EncodePointer, xrefs: 1000AA6F
KERNEL32.DLL, xrefs: 1000AA44
DecodePointer, xrefs: 1000AA85

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 6cb8d5c28d5074f433760f6667332ab0361c674de9d04a8c3266a8bd50229b50
Instruction ID: bcf2beea3aee41d2aa15f995c6c6d73addff0134c8f7c4ab08a319bce46e109a
Opcode Fuzzy Hash: 6cb8d5c28d5074f433760f6667332ab0361c674de9d04a8c3266a8bd50229b50
Instruction Fuzzy Hash: 9F116DB49007469FEB11DF75CC45B9ABBE0EF06380F008519E5A59B291DB34EA80CB11

Function 10015FC0 Relevance: 13.7, APIs: 9, Instructions: 239COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015FFC
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10016018
LeaveCriticalSection.KERNEL32(1002030C), ref: 10016046

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 40f431bcfea2067bdb45210c7ca3e5ac481c5a134223d9d1211dde7a8a90e341
Instruction ID: 371fddef53dbc4fe45c556ef6c540f006288db7d7992a80969627ba83df88eb7
Opcode Fuzzy Hash: 40f431bcfea2067bdb45210c7ca3e5ac481c5a134223d9d1211dde7a8a90e341
Instruction Fuzzy Hash: C191A875A047009FD321CF28CD80A1AB7E5FF88750F418A6DF94A8B252D735E944CB92

Function 10013240 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 207registryCOMMON

Download Yara Rule

APIs

Part of subcall function 10012F40: __snprintf.LIBCMT ref: 10012F6E
Part of subcall function 10012F40: RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000003,?,?,?,?,?), ref: 10012F89

Part of subcall function 10012E20: RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?,?,00000001,?,?,00000000), ref: 10012E39

RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\GroupOrderList,00000000,00000003,?), ref: 1001343E
RegSetValueExA.ADVAPI32(?,PNP_TDI,00000000,00000003,?,00000004), ref: 10013471
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 1001347C

Strings

Tdx, xrefs: 1001335F
PNP_TDI, xrefs: 1001346B
Tcpip, xrefs: 10013376
SYSTEM\CurrentControlSet\Control\GroupOrderList, xrefs: 10013434

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Open$CloseValue__snprintf
String ID: PNP_TDI$SYSTEM\CurrentControlSet\Control\GroupOrderList$Tcpip$Tdx
API String ID: 955868693-1105926044
Opcode ID: fda263ff1de41ce67b71e2831dee39c8819067ff8ff0548a34e60e809be7e6e4
Instruction ID: 9d99394d333599788a4544cf258fe4bbb44c0789f27ec8b116fc68fb94e8051e
Opcode Fuzzy Hash: fda263ff1de41ce67b71e2831dee39c8819067ff8ff0548a34e60e809be7e6e4
Instruction Fuzzy Hash: 236107715003019BC711DF28C881B9BB7E5FB81794F508B2CF9A59B181E732FA9AC792

Function 10003970 Relevance: 12.3, APIs: 8, Instructions: 344COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 100039B6
EnterCriticalSection.KERNEL32(10020168), ref: 10003C89
LeaveCriticalSection.KERNEL32(10020168), ref: 10003CBA
_malloc.LIBCMT ref: 10003CBE
LeaveCriticalSection.KERNEL32(?), ref: 10003CDD
LeaveCriticalSection.KERNEL32(10020168), ref: 10003D10
LeaveCriticalSection.KERNEL32(?), ref: 10003D80
LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003DA0

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
Instruction ID: cb4e14372f68c81d32fb7b051c2ec7f8ea7fe710ba1d4691e8c8f5f753e74d5d
Opcode Fuzzy Hash: 73d3a381d48c90c82b24558e07d01c406c18051549b067fe898d807a957dde11
Instruction Fuzzy Hash: 84D147755043459FE721EF24C98095AB7E9FF88790F02C91DE8999B249DB31FA00CFA2

Function 10002EF0 Relevance: 12.3, APIs: 8, Instructions: 344COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10002F36
EnterCriticalSection.KERNEL32(10020168), ref: 10003209
LeaveCriticalSection.KERNEL32(10020168), ref: 1000323A
_malloc.LIBCMT ref: 1000323E
LeaveCriticalSection.KERNEL32(?), ref: 1000325D
LeaveCriticalSection.KERNEL32(10020168), ref: 10003290
LeaveCriticalSection.KERNEL32(?), ref: 10003300
LeaveCriticalSection.KERNEL32(1001AF8C), ref: 10003320

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 6e5e0db70783d2082ef5619a72b906c060462fccdc8a4732c9d5e6cd8a7c2023
Instruction ID: 7535f423654ff115b8a10d663302ad89ce6d265461ec07cf54a4ab5d377fff5f
Opcode Fuzzy Hash: 6e5e0db70783d2082ef5619a72b906c060462fccdc8a4732c9d5e6cd8a7c2023
Instruction Fuzzy Hash: 35D159755043459FE721DF54C98095AB7E9FF88790F12CA2DE8998B249DB30FA00CFA2

Function 10015980 Relevance: 12.1, APIs: 8, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,?,?,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 10015994
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159AA
EnterCriticalSection.KERNEL32(10020168,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159BD
LeaveCriticalSection.KERNEL32(10020168,?,?,?,10015F9A,?,?,?,?,00000000,00000000), ref: 100159EA
_malloc.LIBCMT ref: 100159EE
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015A0D

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 83a868a5a413f7be5035703166637c7b296de766c062b8faf5188e187a6a0587
Instruction ID: 716dd50c4406e69af5a644168b3a8d86a91ffbed9d73fa53db93a722c9a7554d
Opcode Fuzzy Hash: 83a868a5a413f7be5035703166637c7b296de766c062b8faf5188e187a6a0587
Instruction Fuzzy Hash: 86310972601315CFD711CF6CDC80999B7E6EF94262B6A822BF558CF251DB32D8448B92

Function 10015AA0 Relevance: 12.1, APIs: 8, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,?,?,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015AB4
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015ACA
EnterCriticalSection.KERNEL32(10020168,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015ADD
LeaveCriticalSection.KERNEL32(10020168,?,?,?,1001636E,?,00000000,?,?,00000000,00000000), ref: 10015B0A
_malloc.LIBCMT ref: 10015B0E
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015B2D

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 0b1f382d706e44ec0e1a58c49b7b50b2d9c2de06ca5ddb6f4ca569de45bb812b
Instruction ID: 0036e264ff8d4791e783871741635e394cc451c67550918a7cfab00ff319ecfa
Opcode Fuzzy Hash: 0b1f382d706e44ec0e1a58c49b7b50b2d9c2de06ca5ddb6f4ca569de45bb812b
Instruction Fuzzy Hash: BC310B72641355CFD311CF2CDC80999B3E5EF94262B6A422BF559CF252DB32E8448B91

Function 10014B10 Relevance: 12.1, APIs: 8, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014B16
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014B2B
DeviceIoControl.KERNEL32(FFFFFFFF,002201BC,00000000,00000000,00000000,00000000,?,00000000), ref: 10014B54
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014B5F

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 02bb3fff05f25983f8711dfb826126a47c4f04985e71065dc7fb2bdb1fcbf30f
Instruction ID: 02a2f6b1c1c0d08758aff6957e8ee0c5b887a2a9afcc407cdac575b478d4874d
Opcode Fuzzy Hash: 02bb3fff05f25983f8711dfb826126a47c4f04985e71065dc7fb2bdb1fcbf30f
Instruction Fuzzy Hash: 2521E772359311BFF210CBA8ACC6F963399EB84F71F224609F715AA0D1DF70E8448666

Function 10014C00 Relevance: 12.1, APIs: 8, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014C06
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014C1B
DeviceIoControl.KERNEL32(FFFFFFFF,002201BC,00000000,00000000,00000000,00000000,?,00000000), ref: 10014C44
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014C4F

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 19f12ee8c8cf86aad4f1a8f5e61e85f259d81ceda6a06445ab1c933b9452340a
Instruction ID: 4bb90ba6e2ddb0c313f38f00bcf08c1032174cdcc12a3aad3dba23a14210028a
Opcode Fuzzy Hash: 19f12ee8c8cf86aad4f1a8f5e61e85f259d81ceda6a06445ab1c933b9452340a
Instruction Fuzzy Hash: 4A210872351311BFF210C7A8AC85F967399EB88F71F224608F7149A0D1DFB0E94486A5

Function 100179F0 Relevance: 12.1, APIs: 8, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,00000000,?,10017CBE), ref: 100179F9
ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A2E
ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A37
ResetEvent.KERNEL32(FFFFFFFF,?,10017CBE), ref: 10017A40
SetEvent.KERNEL32(FFFFFFFF), ref: 10017A67
LeaveCriticalSection.KERNEL32(1002030C,?,10017CBE), ref: 10017A7C
WaitForSingleObject.KERNEL32(FFFFFFFF,000000FF), ref: 10017A96
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017AA1

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Event$CriticalResetSection$Leave$EnterObjectSingleWait
String ID:
API String ID: 227606595-0
Opcode ID: 0af12d4d274b4158eff6cb139f5dbd0a4003279a660a605caf6bf13278f8ed7d
Instruction ID: 370ae82c3914d7338aeaefb3dba61d6cd4c1daa1705ad23ed54f4bf6628b88f1
Opcode Fuzzy Hash: 0af12d4d274b4158eff6cb139f5dbd0a4003279a660a605caf6bf13278f8ed7d
Instruction Fuzzy Hash: 93115E729103719FF315DB648C88B5937A9EB4C761F21C319FA29861E1DB30D9418F91

Function 100169E0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10016A2B
GetTickCount.KERNEL32 ref: 10016B87
GetTickCount.KERNEL32 ref: 10016CFD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,76EBFFB0,00000000), ref: 10017214
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001721F

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$CountEnterTick$Leave
String ID:
API String ID: 1274362258-0
Opcode ID: ef1edd5c790a106658f1642739d45defef9679afc4e8f9f2e44516cc589d5311
Instruction ID: 3fd2e9f8bc7037484baf15cc0afc36f40eff77f3799c9f8376e09abcfaaf5b27
Opcode Fuzzy Hash: ef1edd5c790a106658f1642739d45defef9679afc4e8f9f2e44516cc589d5311
Instruction Fuzzy Hash: 9BD15775A04645EFDB10CF14CC80A9AB7F5FF88354F108529F9598B252EB34FA86CBA1

Function 1000F36B Relevance: 10.7, APIs: 7, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 1000F384

Part of subcall function 1000F2F1: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1000F2FE
Part of subcall function 1000F2F1: GetOEMCP.KERNEL32(00000000,?,1000D589,?,00000000,7591F380), ref: 1000F318

setSBCS.LIBCMT ref: 1000F396

Part of subcall function 1000F06E: _memset.LIBCMT ref: 1000F081

IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,1001B930), ref: 1000F3DC
GetCPInfo.KERNEL32(00000000,1000F6EE), ref: 1000F3EF
_memset.LIBCMT ref: 1000F407
setSBUpLow.LIBCMT ref: 1000F4DA

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Locale_memset$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 2658552758-0
Opcode ID: a816b4c44936828a5225c1a25b1e8420490dbca548ce3019b9a4bf18463ab438
Instruction ID: 2d63987005470fd1933f97c79db1aac5b43ce9987930df9b1300e43a0dccfd1d
Opcode Fuzzy Hash: a816b4c44936828a5225c1a25b1e8420490dbca548ce3019b9a4bf18463ab438
Instruction Fuzzy Hash: C25112719042568BEB15CF24C8802BFBBE4EF043C1F14846EED869B54AD638DA42EB91

Function 10015830 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10015845
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015855
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001586D
EnterCriticalSection.KERNEL32(10020168), ref: 10015874
LeaveCriticalSection.KERNEL32(10020168), ref: 100158A4
_malloc.LIBCMT ref: 100158A8

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
Instruction ID: b4838676840f3e74a045a70f2e4b7778d9ead1c68319ad0b4665687bbdc5929c
Opcode Fuzzy Hash: af66a572ff308366c586223bea1b859f2b64d82aec888bcbbc6575e257e25f9f
Instruction Fuzzy Hash: EC31E532A002148FD711DF2CDC81969B3D6FF84261B59866AE828DF291EB32DC548BD1

Function 10015510 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001551F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015533
__aullrem.LIBCMT ref: 10015558
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 1001557E

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: d1b92c9a15aa5841480ea886cd8603e293953e3d95721df58c3ef1283f84292e
Instruction ID: eb2839e93686e6e60da02978a6273212bfb1d6ef73694f74e7e96aae41cfea2c
Opcode Fuzzy Hash: d1b92c9a15aa5841480ea886cd8603e293953e3d95721df58c3ef1283f84292e
Instruction Fuzzy Hash: 002104367006148FD310CB6DEC88A5577EBEF88672F654269FA1CCF291DB32D88486D0

Function 10015740 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10015753
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015763
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001577A
EnterCriticalSection.KERNEL32(10020168), ref: 10015781
LeaveCriticalSection.KERNEL32(10020168), ref: 100157A8
_malloc.LIBCMT ref: 100157AC

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$_malloc
String ID:
API String ID: 2624469294-0
Opcode ID: 8d90196d2bee32e8d3484feec3460c9a7be0d346ac3607533073b5423734d643
Instruction ID: 49e631b63e63f54fa41d8579300819fad08862a6ee69802ca296dd5302bd9675
Opcode Fuzzy Hash: 8d90196d2bee32e8d3484feec3460c9a7be0d346ac3607533073b5423734d643
Instruction Fuzzy Hash: 0121A176A04315CBD310DB28EC02A5973D5EB84761B0A436AE8588F2D1DB72D8508BD1

Function 004022B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00402328,00000000,00403482,00000000,00000000,00000314,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022C0
TlsGetValue.KERNEL32(00000006,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022D7
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,0040B040,00401917,0040B040,Microsoft Visual C++ Runtime Library,00012010), ref: 004022EC
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00402307

Strings

KERNEL32.DLL, xrefs: 004022E7
EncodePointer, xrefs: 00402301

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
Instruction ID: 50336ba6c918c6c116f5e3fcbab542df5951bbe2d872b07961eb55563d71e960
Opcode Fuzzy Hash: 1a385f102c7f14214112f7259b1974e6b0907a5b8e91fbf1077ec2ee8662ada9
Instruction Fuzzy Hash: BFF06D301056129BDA529B74EF08A6B7BA5AF40394B15047AB854F62F4CF78CC11DA6D

Function 0040232A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,004024E4,?,?,0040199A), ref: 00402363
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040237E

Strings

KERNEL32.DLL, xrefs: 0040235E
DecodePointer, xrefs: 00402378

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
Instruction ID: b3a0eb18012e6aadf2811430fba97e87ad444e4cba862865431688a9bf4f90a9
Opcode Fuzzy Hash: b796f7a9d0800bb9e160982425eb8aa8e27173a6ee7dc456a018aa060cd778d7
Instruction Fuzzy Hash: A1F01230501623ABD712A734DF08A5B3AA59F41390715413ABC58F62F4DB7CCD12865D

Function 1000A8A7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,1000A91C,00000000,1000EA20,00000000,00000000,00000314,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8B4
TlsGetValue.KERNEL32(00000002,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8CB
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,1001F3B0,1000A694,1001F3B0,Microsoft Visual C++ Runtime Library,00012010), ref: 1000A8E0
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1000A8FB

Strings

EncodePointer, xrefs: 1000A8F5
KERNEL32.DLL, xrefs: 1000A8DB

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
Instruction ID: caffd8b91c38bffb5cca897b74d77eec42bfe04cae3721fbb3b20170df584618
Opcode Fuzzy Hash: 698cc03a02ed437f9e78c1477e8a38eecfbfb8aad5433eb0b7b92186c3789519
Instruction Fuzzy Hash: D9F01D30A05626AFFA51DB24CC8895A3BD8DF467D07028624F854E71B8DF30CED29B51

Function 1000A91E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A957
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1000A972

Strings

KERNEL32.DLL, xrefs: 1000A952
DecodePointer, xrefs: 1000A96C

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
Instruction ID: bd257daf5de9dee36b7a7df8f8d7f9ef99228c3852669747f2885a7cf79806d7
Opcode Fuzzy Hash: 849bf8aa20e695c811e63e4f389fbd3f38ad5f5727a41dc013945db67583cb91
Instruction Fuzzy Hash: 9FF0F930A056229EEA52DB248C8899A7BD8EF463D07028224F968D7168DB30CDD18A51

Function 10001818 Relevance: 10.2, APIs: 8, Instructions: 231COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(1002030C), ref: 100018A4
LeaveCriticalSection.KERNEL32(1002030C), ref: 100018E0
EnterCriticalSection.KERNEL32(1002030C), ref: 10001916
LeaveCriticalSection.KERNEL32(1002030C), ref: 100019BE
LeaveCriticalSection.KERNEL32(1002030C), ref: 10001A02
EnterCriticalSection.KERNEL32(1002030C), ref: 10001A3C
EnterCriticalSection.KERNEL32(?), ref: 10001AA3
EnterCriticalSection.KERNEL32(?), ref: 10001AF7
EnterCriticalSection.KERNEL32(?), ref: 10001B76
LeaveCriticalSection.KERNEL32(1002030C), ref: 10002045

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
Instruction ID: 1c7db7b73577996e6f6b7cc1b13f752c77784736a4bb66c20c39e3569af504b5
Opcode Fuzzy Hash: 1148cbf5bdb9481604341125c06b22783845d375c7f4a15b8700bf0034355e6e
Instruction Fuzzy Hash: 3891D370A04384CFE710CF68C880B9AB7E6FF89384F45855DF8858B256D775E985CB62

Function 10017880 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178C1
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,10018530,000000FF), ref: 100178DD
LeaveCriticalSection.KERNEL32(1002030C), ref: 10017906

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
Instruction ID: 744bdcced945026e525a1d70fd2b130064bd5c13945d0ecf707bb38ae523f875
Opcode Fuzzy Hash: 4fadeff10b6c9a286b6e83259b0211dd6e584e032f721b146db71c1fbee9745d
Instruction Fuzzy Hash: 9141BF766083488FD700CF68EC8175AB7E9FB48764F10862AFD598B391DB35EA448A91

Function 10013EE0 Relevance: 9.1, APIs: 6, Instructions: 93COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168,?,?,?,?,10016A9A,?,?,?,76EBFFB0,00000000), ref: 10013EE9
LeaveCriticalSection.KERNEL32(10020168), ref: 10013F17
_malloc.LIBCMT ref: 10013F22
LeaveCriticalSection.KERNEL32(10020168), ref: 10013F69
_memset.LIBCMT ref: 10013F7C
GetTickCount.KERNEL32 ref: 10013FA6

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$CountEnterTick_malloc_memset
String ID:
API String ID: 3854238366-0
Opcode ID: ac07afc8388a069d4f83166ba5a0569cc62fde9cdb2ff454ac3c5f1d52a80147
Instruction ID: 4ca0d7073e46e878efecada07f93c2f81ca96af553993ca0a0a66e884ec48b02
Opcode Fuzzy Hash: ac07afc8388a069d4f83166ba5a0569cc62fde9cdb2ff454ac3c5f1d52a80147
Instruction Fuzzy Hash: E23137B59003058FD745CF28DC80A867BF9FF49340B5182BAEC099F266EB31E955CB91

Function 10015EE0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10015EEF
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015F03
__aullrem.LIBCMT ref: 10015F28
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 10015F4E

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: 7ccb25e048fed005f5e0ad39f41a19acd61739f9bb35c0086ce996b125a16670
Instruction ID: 962ddd3524da1f0e37931dc98e1f0c185814ed2e642f679040aa4322ebcbbac0
Opcode Fuzzy Hash: 7ccb25e048fed005f5e0ad39f41a19acd61739f9bb35c0086ce996b125a16670
Instruction Fuzzy Hash: 03213835300214DFC300CB69EC889A9B7DADB84572B5942B9FE18CF292E732DD4087A0

Function 100148A0 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C,?,?,00000001,?,10016ABE,?,?,-00000067,?,?,?,76EBFFB0,00000000), ref: 100148A9
LeaveCriticalSection.KERNEL32(1002030C,?,10016ABE,?,?,-00000067,?,?,?,76EBFFB0,00000000), ref: 100148BD
_memset.LIBCMT ref: 100148E2
DeviceIoControl.KERNEL32(FFFFFFFF,00220194,00000000,0000002C,00000000,0000002C,?,00000000), ref: 10014917
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014942

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter_memset
String ID:
API String ID: 589867189-0
Opcode ID: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
Instruction ID: c706671d47631c6094ceacd85374c5c19a88f26d1054e66b0f3edaf9514eb2f3
Opcode Fuzzy Hash: 8ebd72944f7a2a950c9ee27789203da092cdf93c9c74612e77d64f55a2891e3a
Instruction Fuzzy Hash: 971184752043119FE700DF64ECC5F5B77A9EF88765F218629F2199E1D2CB30D9498A60

Function 10015610 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(FFFFFFFF,?,?,?,100156AB), ref: 1001561F
WaitForSingleObject.KERNEL32(FFFFFFFF,000000FF,?,?,?,100156AB), ref: 1001563F
CloseHandle.KERNEL32(FFFFFFFF,?,?,?,100156AB), ref: 1001564C
SetEvent.KERNEL32(?,?,?,?,100156AB), ref: 1001566D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,100156AB), ref: 1001567C
CloseHandle.KERNEL32(?,?,?,?,100156AB), ref: 10015684

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID:
API String ID: 2055531096-0
Opcode ID: 2b52fc261705a2240190288487bb20031f43a560c2463843fdaa4baee3aae0d6
Instruction ID: f07f506387550c76cd1d2b3446689fb9bb28019f0ffc834db263f1ad7541274e
Opcode Fuzzy Hash: 2b52fc261705a2240190288487bb20031f43a560c2463843fdaa4baee3aae0d6
Instruction Fuzzy Hash: F7014B719003A19BE710DB69CCC4A1973A9A749374BB0C708F1348B6F1CB34E8828F24

Function 10016427 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32 ref: 1001646C
GetDriveTypeW.KERNEL32(?,?,?,?,?,?), ref: 100165A1
EnterCriticalSection.KERNEL32(10020484), ref: 10016726
LeaveCriticalSection.KERNEL32(10020484), ref: 10016742

Strings

:, xrefs: 1001645A

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$DeviceDriveEnterLeaveQueryType
String ID: :
API String ID: 2472114325-336475711
Opcode ID: 5d0bb1d3aef29e5e2cf54168e896612a3619c67b40a50f6bad3d4d47fe3ea62b
Instruction ID: 266c0d949fe9e03b7784f1c108ca597e8a181d292a197a77467f75c32d12edc8
Opcode Fuzzy Hash: 5d0bb1d3aef29e5e2cf54168e896612a3619c67b40a50f6bad3d4d47fe3ea62b
Instruction Fuzzy Hash: 829149B54083818BE720CB64CC95B9BB7E5FF88344F44891EE6C98B255DB71E688CB53

Function 10010975 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 10010A43
__flsbuf.LIBCMT ref: 10010A70
_wctomb_s.LIBCMT ref: 10010AD3
__flsbuf.LIBCMT ref: 10010B08
__flswbuf.LIBCMT ref: 10010B3D

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: __flsbuf$__flswbuf_wctomb_s
String ID:
API String ID: 3257920507-0
Opcode ID: a75cccfa23d7aea3e5714c7e6dfbd81455f4b56c440ddb5dee57a86975d0e6af
Instruction ID: aaf0d67127a989ff9fc8068fecdd25abf0f0f1beb550e9f4a5d15db8321f0729
Opcode Fuzzy Hash: a75cccfa23d7aea3e5714c7e6dfbd81455f4b56c440ddb5dee57a86975d0e6af
Instruction Fuzzy Hash: B351F43A3046559BD724CF2898829AE77A4EF063B4B60060AF4E59F2D2DBB4E9C1C751

Function 100172B0 Relevance: 7.7, APIs: 5, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10017308
DeviceIoControl.KERNEL32(FFFFFFFF,00220198,?,00000004,?,?,1002030C,00000000), ref: 10017352

Part of subcall function 10015070: EnterCriticalSection.KERNEL32 ref: 100150AF
Part of subcall function 10015070: LeaveCriticalSection.KERNEL32(10020484,00000000,000000FF,00000000,000000FF,?,00000000), ref: 1001517C

LeaveCriticalSection.KERNEL32(1002030C,?), ref: 100174C8
SetLastError.KERNEL32(00000008), ref: 100174EB
LeaveCriticalSection.KERNEL32(1002030C), ref: 100174F6

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ControlDeviceErrorLast
String ID:
API String ID: 4103992608-0
Opcode ID: 0c15b7dd3d47d1301ec5051b298948f62488c9d0a0b22cccd62178c255bc7e81
Instruction ID: 069ed3d1de4671eec97c8a091bf5bc0cd7826cd6fef9fe84e4e00e0bd1a0d2d6
Opcode Fuzzy Hash: 0c15b7dd3d47d1301ec5051b298948f62488c9d0a0b22cccd62178c255bc7e81
Instruction Fuzzy Hash: 6B519B755183819FD320CB24C841B9BBBE8FF85750F408A1DF5998B291DB74E949CB93

Function 00403CA8 Relevance: 7.7, APIs: 5, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

getSystemCP.LIBCMT ref: 00403CC1

Part of subcall function 00403C2E: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00403C3B
Part of subcall function 00403C2E: GetOEMCP.KERNEL32(00000000,?,00401DD5), ref: 00403C55

setSBCS.LIBCMT ref: 00403CD3
IsValidCodePage.KERNEL32(-00000030,00000000,?,00000000,00409560), ref: 00403D19
GetCPInfo.KERNEL32(00000000,0040402B), ref: 00403D2C
setSBUpLow.LIBCMT ref: 00403E17

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: Locale$CodeInfoPageSystemUpdateUpdate::_Valid
String ID:
API String ID: 364485666-0
Opcode ID: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
Instruction ID: 7ec157c4a63f4bee73c0373c95dbc61b6731b50ec73e293603ddc6fd57e301c6
Opcode Fuzzy Hash: f8562f73fbf6c12a93af662bf149bbf5becb5a351e9a22bc92b3aca215f4718f
Instruction Fuzzy Hash: 8451E5719042549BDB15DF29C8806BABFA8EF05306F14817BD885BB2C2D63CDA46CBD9

Function 10016860 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 10016897
EnterCriticalSection.KERNEL32 ref: 100168B8
?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPBDH@Z.NFAPI(?,?,00000000,00000000), ref: 10016931
LeaveCriticalSection.KERNEL32(1002030C), ref: 10016948
SetEvent.KERNEL32(?), ref: 100169C9

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$?nf_tcpCountEnterEventLeavePostReceive@nfapi@@S@@_Tick
String ID:
API String ID: 2201467506-0
Opcode ID: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
Instruction ID: 742bec59b4eacf5a62cee880053408559a72dd2c9328244c4bf56ef4399b46ed
Opcode Fuzzy Hash: 3b8d782bd27df50b16dfc65a62725b0131aeeeb5184073b4607cf5be4256a305
Instruction Fuzzy Hash: E0418B709087819FE310CF24CC84A6ABBEAFB88754F50491DF8D68B651D735ED858B42

Function 10013D10 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168), ref: 10013D19
LeaveCriticalSection.KERNEL32(10020168), ref: 10013D47
_malloc.LIBCMT ref: 10013D52
LeaveCriticalSection.KERNEL32(10020168), ref: 10013D99
_memset.LIBCMT ref: 10013DAC

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter_malloc_memset
String ID:
API String ID: 923394041-0
Opcode ID: d2436b13b8ff33d81ad853f571cd7b4f84e6fc360ee8814cc5edca94589bfc8a
Instruction ID: 7167e3c78dd255bc3be61e05a3690e11657a4ad0a516055890c14454ff31153c
Opcode Fuzzy Hash: d2436b13b8ff33d81ad853f571cd7b4f84e6fc360ee8814cc5edca94589bfc8a
Instruction Fuzzy Hash: D4319CB15013018FE749CF18ECC1A567BA5FF98304B2582AEE8099F366DB31E959CF90

Function 10014090 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014096
LeaveCriticalSection.KERNEL32(1002030C), ref: 100140AA
DeviceIoControl.KERNEL32(FFFFFFFF,00000000,?,0000025B,00000000,00000000,?,00000000), ref: 10014137
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014147

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
Instruction ID: 943a08fe69652d90c9d1f998fde71af210911f062dc05d4fd50d64c2a8c94902
Opcode Fuzzy Hash: c7db852ffef9afacecec687bb358ebba848a58d4b521bdcfc675cc6101f49ccd
Instruction Fuzzy Hash: BE110A76500210AFE705CB68DC89ADB33D9EF88760F118219F6128B1E1EF70DA84C690

Function 100162D0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100162DF
__aullrem.LIBCMT ref: 100162F8
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 1001631E
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 10016346
LeaveCriticalSection.KERNEL32(1002030C), ref: 10016378

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: a12b99a6437fde0b1fddeed73491248cb1b45896119e412d513d9bd3dbe0284c
Instruction ID: 8b44c5907cacb563da89275e12a7b823dc438703cb38c6685e6cf52fab2f5aee
Opcode Fuzzy Hash: a12b99a6437fde0b1fddeed73491248cb1b45896119e412d513d9bd3dbe0284c
Instruction Fuzzy Hash: E3115B313002059FD700CB69EC88DAEB3DEEF89561B5581A5FD08CF292E732ED5083A0

Function 10014970 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001497F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014993
__aullrem.LIBCMT ref: 100149B8
LeaveCriticalSection.KERNEL32(1002030C,?,?,00000000,00000000), ref: 100149DE

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter__aullrem
String ID:
API String ID: 1392406986-0
Opcode ID: 2404607320ef2a75d0717d5302f9e8fa9c4f34ddd1540ab3d998488c8b00b57d
Instruction ID: 4e2cb47ff58eaee26e2a48776ae77e93d28fc32bba7de68dc87d4d27a697fb70
Opcode Fuzzy Hash: 2404607320ef2a75d0717d5302f9e8fa9c4f34ddd1540ab3d998488c8b00b57d
Instruction Fuzzy Hash: 441104317002449FD310CB68EC88F9A77DAEF85671F524295FA588B2A2DB31DC848691

Function 100152E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100152EF
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015303
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015321

Strings

B, xrefs: 10015353

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: B
API String ID: 2978645861-1255198513
Opcode ID: d389180647d33e7fd7909b68b13a63dafe69a50724e4bfe4741239f59ea6ff70
Instruction ID: 5862e67234fadea20cb6fb71e4dcca28f21175ac499c2c8a774871cc376374ad
Opcode Fuzzy Hash: d389180647d33e7fd7909b68b13a63dafe69a50724e4bfe4741239f59ea6ff70
Instruction Fuzzy Hash: C711C2327002188BDB01CF69ECC4599B7A5FF443B1B54826AFE2CCF292DB71D94486D0

Function 100144A0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100144A8
LeaveCriticalSection.KERNEL32(1002030C), ref: 100144EC
DeviceIoControl.KERNEL32(FFFFFFFF,002201B4,?,00000014,00000000,00000000,00000000,00000000), ref: 10014513
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014522
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014533

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: a308096551d9751a7049de7f445834c6eeaff320b8b2092d6412a4f98500842a
Instruction ID: a46a0420c4f18f8497baad094036f26d02c65c78e58f58d61c697df38c55562f
Opcode Fuzzy Hash: a308096551d9751a7049de7f445834c6eeaff320b8b2092d6412a4f98500842a
Instruction Fuzzy Hash: C7113C746147019FE304DF28DC85B5677E6FF88B21F81C64CF9598B2A2D770D908CA92

Function 100146D0 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100146D6
LeaveCriticalSection.KERNEL32(1002030C), ref: 100146EC
DeviceIoControl.KERNEL32(FFFFFFFF,002201A4,?,00000010,?,00000004,?,00000000), ref: 1001471D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014738

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: b6876661e5ff2c24c9972b30366f10f5fdaa2126c1ee03cc0ae946e3fb77ca8f
Instruction ID: 2fba52e4ee8d058ba920c3b194ab9f094fa0f14e2d16636bf92fac5c4c939877
Opcode Fuzzy Hash: b6876661e5ff2c24c9972b30366f10f5fdaa2126c1ee03cc0ae946e3fb77ca8f
Instruction Fuzzy Hash: 7701D630715320AFE301CB24DC48BA633DAEF85B71F128609F6598B0E1CF70C984C6A1

Function 00404039 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00404057

Part of subcall function 00402D12: __mtinitlocknum.LIBCMT ref: 00402D26
Part of subcall function 00402D12: __amsg_exit.LIBCMT ref: 00402D32
Part of subcall function 00402D12: EnterCriticalSection.KERNEL32(?,?,?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 00402D3A

___sbh_find_block.LIBCMT ref: 00404062
___sbh_free_block.LIBCMT ref: 00404071
HeapFree.KERNEL32(00000000,?,00409580,0000000C,00402CF3,00000000,004094A0,0000000C,00402D2B,?,?,?,00405EA1,00000004,00409600,0000000C), ref: 004040A1
GetLastError.KERNEL32(?,00405EA1,00000004,00409600,0000000C,0040411A,?,?,00000000,00000000,00000000,004024F8,00000001,00000214), ref: 004040B2

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
Instruction ID: bb3a9ea6063299376b196d4342a46263de040b943687fa37fdfcb015542456c3
Opcode Fuzzy Hash: c53e33b7dcff97c89c7848c55f26829c9334c78826d435bd8598ab40913ee6d4
Instruction Fuzzy Hash: 540184B2941301AADB207BB29E0AB5E37649F80324F10423FF7047A2D2CB7C89449A9C

Function 10001210 Relevance: 7.5, APIs: 5, Instructions: 44synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10001340: EnterCriticalSection.KERNEL32(?,?,?,?,100156AB), ref: 10001378
Part of subcall function 10001340: LeaveCriticalSection.KERNEL32(10020350,?,?,?,?,?,?,?,100156AB), ref: 100013BF

SetEvent.KERNEL32(?,6E39044B,?,?,?,1001885B,000000FF), ref: 1000124D
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,1001885B,000000FF), ref: 10001266
CloseHandle.KERNEL32(?,?,?,?,1001885B,000000FF), ref: 10001273
DeleteCriticalSection.KERNEL32(10020350,?,?,?,1001885B,000000FF), ref: 10001284
CloseHandle.KERNEL32(?,?,?,?,1001885B,000000FF), ref: 10001295

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterEventLeaveObjectSingleWait
String ID:
API String ID: 2474944948-0
Opcode ID: 1e9d32bd37262b913d57dc8945bf0fb53b1a93de7becb73826e872e3e5311905
Instruction ID: 64c5f76c38a82e9d846c98533c0514a9f92b4564d6453463f8853accf3b8306c
Opcode Fuzzy Hash: 1e9d32bd37262b913d57dc8945bf0fb53b1a93de7becb73826e872e3e5311905
Instruction Fuzzy Hash: E2015B71504760DFE750DF28CC88A4A77A9EB48730F608B09F439D76E1D734AA418B61

Function 10007B2F Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 10007B4D

Part of subcall function 10009513: __mtinitlocknum.LIBCMT ref: 10009527
Part of subcall function 10009513: __amsg_exit.LIBCMT ref: 10009533
Part of subcall function 10009513: EnterCriticalSection.KERNEL32(?,?,?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 1000953B

___sbh_find_block.LIBCMT ref: 10007B58
___sbh_free_block.LIBCMT ref: 10007B67
HeapFree.KERNEL32(00000000,00000001,1001B588,0000000C,100094F4,00000000,1001B628,0000000C,1000952C,00000001,?,?,1000F77D,00000004,1001B950,0000000C), ref: 10007B97
GetLastError.KERNEL32(?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 10007BA8

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: a001902257452df3a09ef7874541bacfe911b9a4d4b91542b9a5e470de5e31ec
Instruction ID: 4bde7f342c64e4d2018f3ae2fc3c74ed1e6debbda6c59ac2aa0521a4ba985f47
Opcode Fuzzy Hash: a001902257452df3a09ef7874541bacfe911b9a4d4b91542b9a5e470de5e31ec
Instruction Fuzzy Hash: 8501D639C00715AAFB21DBB18C09B5E36A4FF003E1F204209F518A6098CF3CEA40CB65

Function 10014420 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014426
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001443C
DeviceIoControl.KERNEL32(FFFFFFFF,002201B8,?,00000004,?,00000010,?,00000000), ref: 1001446F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014484

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: d5d1587f7f7b2bd1b6f3903fe53ac465cdd8ad77325049dbc3963d326160d6bd
Instruction ID: a8c769179fd60e2bf6cd89700ffbf8ba4d12cccd7724cdc3fecdfc68b2935979
Opcode Fuzzy Hash: d5d1587f7f7b2bd1b6f3903fe53ac465cdd8ad77325049dbc3963d326160d6bd
Instruction Fuzzy Hash: 58F03C74214311AFE314DBA49D84B6633DAEF88B61F628608F666C94E1DB70C884DA62

Function 10014540 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014548
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014575
DeviceIoControl.KERNEL32(FFFFFFFF,002201B0,?,0000000C,00000000,00000000,00000000,00000000), ref: 1001459C
LeaveCriticalSection.KERNEL32(1002030C), ref: 100145AB

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: cf9b4901ff1e343b7e26287a133ebef74e919893ac441ab88bcd06e640e03855
Instruction ID: 0eff3ab3fb06489d6740a8c9915ab30779d44775857bedc5cb99c14d77079b55
Opcode Fuzzy Hash: cf9b4901ff1e343b7e26287a133ebef74e919893ac441ab88bcd06e640e03855
Instruction Fuzzy Hash: 73016774514311AFE301DF28CD45B5A77E5EF98B10F918A08F964862E2E774D5048A52

Function 100145D0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100145D8
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014605
DeviceIoControl.KERNEL32(FFFFFFFF,002201AC,?,0000000C,00000000,00000000,00000000,00000000), ref: 1001462C
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001463B

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 6e4f1e0d7d0e21a89da46d87f902386311073b00f14cfb2b082e5294dee19481
Instruction ID: 42d7f987a94a52d01ef36b35c772b808b674778ff1b5ba1bc601a11ad0b11856
Opcode Fuzzy Hash: 6e4f1e0d7d0e21a89da46d87f902386311073b00f14cfb2b082e5294dee19481
Instruction Fuzzy Hash: 6A016274A14311AFF300DF28CD85B5A77E5EF98B10F918A08F968862E2E774D5088A92

Function 100038F0 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020458,0000000A,?,00000000,1001783B), ref: 100038FE
LeaveCriticalSection.KERNEL32(10020458), ref: 1000392C
WaitForSingleObject.KERNEL32(?,00002710), ref: 1000393A
EnterCriticalSection.KERNEL32(10020458), ref: 10003941
LeaveCriticalSection.KERNEL32(10020458), ref: 10003963

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
Instruction ID: 4c8c2d80ac1b079380655c5ec4cbb732bc282f0004f1aa78e3f82d5ff21842fc
Opcode Fuzzy Hash: 3bb25a39c071496a06b616590bfd4f65b77da877f5bd338bfbeae23c9fbe291f
Instruction Fuzzy Hash: 8FF090B1B402655FF704FB98ECD0CA533EAEBCC354760C019FB0593613CA7068069B61

Function 10002E70 Relevance: 7.5, APIs: 5, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(100203D8,0000000A,?,00000000,10017836), ref: 10002E7E
LeaveCriticalSection.KERNEL32(100203D8), ref: 10002EAC
WaitForSingleObject.KERNEL32(?,00002710), ref: 10002EBA
EnterCriticalSection.KERNEL32(100203D8), ref: 10002EC1
LeaveCriticalSection.KERNEL32(100203D8), ref: 10002EE3

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ObjectSingleWait
String ID:
API String ID: 1755037574-0
Opcode ID: 1c097af206b97876061b063052c6263d78874f6a138238f18bb0d2092e23d612
Instruction ID: e43171a4669c4619fb34f8ae264f673014ca4388743921c5762645a7f44c2943
Opcode Fuzzy Hash: 1c097af206b97876061b063052c6263d78874f6a138238f18bb0d2092e23d612
Instruction Fuzzy Hash: 66F03A757103249FF304D7A8DCD0CA973AEEBC8794764405AF741A3226C7B4BA428B61

Function 10014660 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 10014666
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001467B
DeviceIoControl.KERNEL32(FFFFFFFF,002201A8,?,00000004,00000000,00000000,?,00000000), ref: 100146A0
LeaveCriticalSection.KERNEL32(1002030C), ref: 100146AF

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$ControlDeviceEnter
String ID:
API String ID: 3744975357-0
Opcode ID: 1ae83451541ad7b1658e7e77a32fbb5fc71b43354f710eefe43c36ccfaec8dcc
Instruction ID: 3db9b80ac07a141cc6bafe2479cacd36b1aa32743546a89e3ddafa96da967a27
Opcode Fuzzy Hash: 1ae83451541ad7b1658e7e77a32fbb5fc71b43354f710eefe43c36ccfaec8dcc
Instruction Fuzzy Hash: 84F08270251310AFF201C7749C89F553399DF48B22F628708F326C90E1DF70D4049A51

Function 100131B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 100131DB
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00000001), ref: 100131F5
RegCloseKey.ADVAPI32(00000000), ref: 1001321A

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 100131CC

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseOpen__snprintf
String ID: SYSTEM\CurrentControlSet\Services\%s
API String ID: 2649323954-2757632955
Opcode ID: 84ec4fc234ded0ec1746a26bb0a01dea6608cb65e603b7f2fafd6f762602d5c4
Instruction ID: 0e6c5bb0a140b4fe4a8a9fd12908ebb5e2cd1ecdda7a5af6ef08cdde4ffb9b5c
Opcode Fuzzy Hash: 84ec4fc234ded0ec1746a26bb0a01dea6608cb65e603b7f2fafd6f762602d5c4
Instruction Fuzzy Hash: 37F0E6B5A143005BF764DB54C856FEA73E5EB99700F80480CF5D986181DAB59584CA52

Function 100189E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,QueryFullProcessImageNameW), ref: 100189EA
GetProcAddress.KERNEL32(00000000), ref: 100189F1

Strings

QueryFullProcessImageNameW, xrefs: 100189E0
kernel32, xrefs: 100189E5

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: QueryFullProcessImageNameW$kernel32
API String ID: 1646373207-4169370628
Opcode ID: 80ead79f867b9c70acc418535677702e5c57cb3ae286bb14f1603a2e4be25d81
Instruction ID: d4b750a60ec6c6cb5d585284b623d2f8c151284af6f3ea71f4c867148f187fbc
Opcode Fuzzy Hash: 80ead79f867b9c70acc418535677702e5c57cb3ae286bb14f1603a2e4be25d81
Instruction Fuzzy Hash: 7BB092B8400320AFEB01DBE08C8C8953AEEE74E2027008400F60585120CB30C1E0CF15

Function 10018A00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,QueryFullProcessImageNameA), ref: 10018A0A
GetProcAddress.KERNEL32(00000000), ref: 10018A11

Strings

kernel32, xrefs: 10018A05
QueryFullProcessImageNameA, xrefs: 10018A00

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: QueryFullProcessImageNameA$kernel32
API String ID: 1646373207-3526589867
Opcode ID: bfb67a8b5cc4ef26928f28fcb801f94734c3672f5e5d78a8aa3062b54429a572
Instruction ID: 98f50a63cd48d57722deb6357d66e02bf387ff61662be34999bf1d136a449764
Opcode Fuzzy Hash: bfb67a8b5cc4ef26928f28fcb801f94734c3672f5e5d78a8aa3062b54429a572
Instruction Fuzzy Hash: FAB092F14013209FE702ABB08C8C8853AE9EB1A202B108100FB0186121CB38C0D18A12

Function 10018A50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQuerySymbolicLinkObject), ref: 10018A5A
GetProcAddress.KERNEL32(00000000), ref: 10018A61

Strings

ntdll, xrefs: 10018A55
NtQuerySymbolicLinkObject, xrefs: 10018A50

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtQuerySymbolicLinkObject$ntdll
API String ID: 1646373207-3146753317
Opcode ID: 61b53181ddc3a0468bf9acf94f72e8e6d06d1798f52acba3e2d3b8d08e6a28da
Instruction ID: b543b7ade083403f1789f1f0de2ce02b86dca8d31286e88a7640a01fa307330f
Opcode Fuzzy Hash: 61b53181ddc3a0468bf9acf94f72e8e6d06d1798f52acba3e2d3b8d08e6a28da
Instruction Fuzzy Hash: B4B092F0400320AFE701EBA18C8C8863AEAE70A2223008010F70585125CB34C1D48F11

Function 10018A70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtOpenSymbolicLinkObject), ref: 10018A7A
GetProcAddress.KERNEL32(00000000), ref: 10018A81

Strings

NtOpenSymbolicLinkObject, xrefs: 10018A70
ntdll, xrefs: 10018A75

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtOpenSymbolicLinkObject$ntdll
API String ID: 1646373207-699678798
Opcode ID: fdd8a5cfbd6b08d661b471b0597a721e8dc6ba82253e6c59f24492ff2366b510
Instruction ID: ebc436c54efd9b5b1c1cf879c4817285fbe182f6251ddbece40f41faf484d1d2
Opcode Fuzzy Hash: fdd8a5cfbd6b08d661b471b0597a721e8dc6ba82253e6c59f24492ff2366b510
Instruction Fuzzy Hash: 07B092F14403219FE702EBA08D8C8863AEAE70E2037008015F70185122CB34C0D1CA11

Function 10015C80 Relevance: 6.4, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015CBC
LeaveCriticalSection.KERNEL32(1002030C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10015CD8
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015D3B

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 31d074460ceac946c0d193caf96497102455dab9f53a976f00f18180bc0b4a95
Instruction ID: 6b063e24d70fe8b42fc37b21e784bd8b66a1ec8045d673d45357853a068beb0b
Opcode Fuzzy Hash: 31d074460ceac946c0d193caf96497102455dab9f53a976f00f18180bc0b4a95
Instruction Fuzzy Hash: B861AA76905700CFC314CF28D980A5AB7F6FB88661F548A2DF9598B341D736EA44CBA2

Function 10015400 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001540F
LeaveCriticalSection.KERNEL32(1002030C), ref: 10015423
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001546A

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: f884fb650ff68b9350361ec3a5e3420faf4578eaab12f6148c9d3cfc54674c03
Instruction ID: 3b9cdc21f64611186a4f192bef5eff766ae51078ef50db3d8a9c348abcb55b80
Opcode Fuzzy Hash: f884fb650ff68b9350361ec3a5e3420faf4578eaab12f6148c9d3cfc54674c03
Instruction Fuzzy Hash: 2531D1756007149BC710CF2DEC8499A77E5EF88336F10432AF95D8B691D731E9848BD0

Function 10017D00 Relevance: 6.3, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168,00000010,00000000,10015376), ref: 10017D12
LeaveCriticalSection.KERNEL32(10020168), ref: 10017D7B
LeaveCriticalSection.KERNEL32(10020168), ref: 10017DAE
LeaveCriticalSection.KERNEL32(10020168), ref: 10017DC5
LeaveCriticalSection.KERNEL32(10020168), ref: 10017DCE

Part of subcall function 10007B2F: __lock.LIBCMT ref: 10007B4D
Part of subcall function 10007B2F: ___sbh_find_block.LIBCMT ref: 10007B58
Part of subcall function 10007B2F: ___sbh_free_block.LIBCMT ref: 10007B67
Part of subcall function 10007B2F: HeapFree.KERNEL32(00000000,00000001,1001B588,0000000C,100094F4,00000000,1001B628,0000000C,1000952C,00000001,?,?,1000F77D,00000004,1001B950,0000000C), ref: 10007B97
Part of subcall function 10007B2F: GetLastError.KERNEL32(?,1000F77D,00000004,1001B950,0000000C,1000B1A8,?,?,00000000,00000000,00000000,1000AB20,00000001,00000214), ref: 10007BA8

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$EnterErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2683178029-0
Opcode ID: 745b44e389e3eb57d002cadd99901bb83912b5949676a4bdb36c585caf9445f7
Instruction ID: b4225b4be6f6f7a218a50a7cc17e3f5341257b43a51e5c7c058e521d2863d70b
Opcode Fuzzy Hash: 745b44e389e3eb57d002cadd99901bb83912b5949676a4bdb36c585caf9445f7
Instruction Fuzzy Hash: C5219D765003158FD755CF14ED45AAA77B1FF9431570244BEF909CB222DB36D492CB81

Function 100142C0 Relevance: 6.3, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 100142CD
LeaveCriticalSection.KERNEL32(1002030C), ref: 100142E1
LeaveCriticalSection.KERNEL32(1002030C), ref: 100142FE

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 91475d05e9af95ed88a2ca98d537037db2de0cf6f2e51c315e4e122b3160fcb0
Instruction ID: 0688acbf623d954f04115705206b7a5878359c5d24a5a52100af0231af46e52b
Opcode Fuzzy Hash: 91475d05e9af95ed88a2ca98d537037db2de0cf6f2e51c315e4e122b3160fcb0
Instruction Fuzzy Hash: F411A0356102159FC700CF2DEC4489577AAEF89231712835AFD2C877A1EB31E8508AD0

Function 10014370 Relevance: 6.3, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001437D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014391
LeaveCriticalSection.KERNEL32(1002030C), ref: 100143AE

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: af989e02686470c58158b9f9546e3ca7512020e02bc5ed8235ce539b5489efd8
Instruction ID: 4d93d7c43a49986c58b60d74623ea931e304e01d20275fc7b50258dea019b724
Opcode Fuzzy Hash: af989e02686470c58158b9f9546e3ca7512020e02bc5ed8235ce539b5489efd8
Instruction Fuzzy Hash: 2F11A0396102149FC700CF6DEC4489977A9EF88231711835AFD2CC77A1EB31E9118AD1

Function 10014800 Relevance: 6.3, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001480D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014821
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001483E

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
Instruction ID: 77183064e41a1e9205efc12c9dcf8d440c153a8ee4ed2ed3b95b76763cc59ffb
Opcode Fuzzy Hash: 5b0c05bd3bb3b5db66ab5481f23a3e4c1540d4302acacb0ddc367f69b30fcab4
Instruction Fuzzy Hash: 8401B5366102149FD701DF7CAC04899379AEB89632B114366FE2C872E1DF31D95586D1

Function 10014760 Relevance: 6.3, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(1002030C), ref: 1001476D
LeaveCriticalSection.KERNEL32(1002030C), ref: 10014781
LeaveCriticalSection.KERNEL32(1002030C), ref: 1001479E

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 315757dbfcfbb32eb6690a5904ae741756b3478989afcffcdb4784ba547c2fca
Instruction ID: c8b4f41cc937fb26e74b5d9e0f7055d815144c6c2631823094905784c4cc0ea4
Opcode Fuzzy Hash: 315757dbfcfbb32eb6690a5904ae741756b3478989afcffcdb4784ba547c2fca
Instruction Fuzzy Hash: 0D01F5366242148FD700DB7CAC44499339AEF89231B124356FE3C872E1DF31D91186D1

Function 10010B53 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10010B83
__isleadbyte_l.LIBCMT ref: 10010BB7
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,FF000002,?,00000000,?,?,?,1000FF83,?,?,00000001), ref: 10010BE8
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,1000FF83,?,?,00000001), ref: 10010C56

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: d976dae8849e1df09a0b0c0d7ef9455a66fad74b5674ac6a6004c55bf6a0fbc5
Instruction ID: a1dc6150c0cefba4fc0e341efb8d7f9e4622e53aa43daf027c921bb7a998826d
Opcode Fuzzy Hash: d976dae8849e1df09a0b0c0d7ef9455a66fad74b5674ac6a6004c55bf6a0fbc5
Instruction Fuzzy Hash: B0319D31B08246EFDB10DFA4C8849AA7BE5FF00255F1586A9F4A08F1A1D3B0D9C0DB51

Function 100014C0 Relevance: 6.1, APIs: 4, Instructions: 75synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,0000000A,759230B0,00000000,?,76EBFFB0,10017857), ref: 100014D0
WaitForSingleObject.KERNEL32(?,000000FF,?,76EBFFB0,10017857), ref: 1000150F
CloseHandle.KERNEL32(?,?,000000FF,?,76EBFFB0,10017857), ref: 10001522
_memmove_s.LIBCMT ref: 10001573

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseEventHandleObjectSingleWait_memmove_s
String ID:
API String ID: 3037655736-0
Opcode ID: a16a9262e8a1ed26482d417ee0d5e11f3f8b9f0b5b5de5088259525e283d6dc5
Instruction ID: c65eb985cd46562ea4b9b3fa780de754e17b39af8a735433f2001fa7709411ec
Opcode Fuzzy Hash: a16a9262e8a1ed26482d417ee0d5e11f3f8b9f0b5b5de5088259525e283d6dc5
Instruction Fuzzy Hash: 1D217171904A028FB730EB59C88545EB3E6FBC4691711851DE5AB47559DB30FE808BA1

Function 10007E33 Relevance: 6.1, APIs: 4, Instructions: 70threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 10007E6E
CreateThread.KERNEL32(?,?,10007DB3,00000000,?,?), ref: 10007EB2
GetLastError.KERNEL32(?,00003001,?,?,10017A59,00000000,00000000,10017590,00000000,00000000,?,?,10017CBE), ref: 10007EBC
__dosmaperr.LIBCMT ref: 10007ED4

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr
String ID:
API String ID: 84609068-0
Opcode ID: 96a702f07e20c8fc08ba84a89f2686319f8a34372d6dff5ac5e6610c97b7c4f9
Instruction ID: 960ca24b8c0fd74316a4ffc7f982722606d32842def4c8c8f75851161ce74b88
Opcode Fuzzy Hash: 96a702f07e20c8fc08ba84a89f2686319f8a34372d6dff5ac5e6610c97b7c4f9
Instruction Fuzzy Hash: 2B113636902249BFFB01EFA4DC8288E77E5FF083E0B214569F509A3095DB34AE018B60

Function 10002B30 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(100203D8,6E39044B,?,?,?,?,1001875C,000000FF), ref: 10002B72

Part of subcall function 100014C0: SetEvent.KERNEL32(?,0000000A,759230B0,00000000,?,76EBFFB0,10017857), ref: 100014D0
Part of subcall function 100014C0: WaitForSingleObject.KERNEL32(?,000000FF,?,76EBFFB0,10017857), ref: 1000150F
Part of subcall function 100014C0: CloseHandle.KERNEL32(?,?,000000FF,?,76EBFFB0,10017857), ref: 10001522
Part of subcall function 100014C0: _memmove_s.LIBCMT ref: 10001573

CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002B93
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002BAA
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10002BE7

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteEventObjectSectionSingleWait_memmove_s
String ID:
API String ID: 3715746028-0
Opcode ID: 76179a229a830d2f9d329135d3ac3756b66c2c4d1d0f11458de3c9b5cfab1ecf
Instruction ID: cfe803f662d768d14c2dfa4e60897070c9f65bc5c6aa7f7d02d73ff30c3c2152
Opcode Fuzzy Hash: 76179a229a830d2f9d329135d3ac3756b66c2c4d1d0f11458de3c9b5cfab1ecf
Instruction Fuzzy Hash: 80217CB05043A18FF300DF688C8560A7BDEFB042B4FA04B19F465D72E7C779AA058B91

Function 100035B0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(10020458,6E39044B,?,?,?,?,1001875C,000000FF), ref: 100035F2

Part of subcall function 100014C0: SetEvent.KERNEL32(?,0000000A,759230B0,00000000,?,76EBFFB0,10017857), ref: 100014D0
Part of subcall function 100014C0: WaitForSingleObject.KERNEL32(?,000000FF,?,76EBFFB0,10017857), ref: 1000150F
Part of subcall function 100014C0: CloseHandle.KERNEL32(?,?,000000FF,?,76EBFFB0,10017857), ref: 10001522
Part of subcall function 100014C0: _memmove_s.LIBCMT ref: 10001573

CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10003613
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 1000362A
CloseHandle.KERNEL32(?,?,?,?,?,1001875C,000000FF), ref: 10003667

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteEventObjectSectionSingleWait_memmove_s
String ID:
API String ID: 3715746028-0
Opcode ID: 63cec45596fa0ece01aef7757e97c95d257c6fcde774a1e3c521d25e9a1047f9
Instruction ID: e4b86ddf39c1be931d4e7214d39989b71f3d296ab9120b50707eace9ea249c52
Opcode Fuzzy Hash: 63cec45596fa0ece01aef7757e97c95d257c6fcde774a1e3c521d25e9a1047f9
Instruction Fuzzy Hash: 9621A1F49043919FE310EF6C8C8860A7BDAF704274FE08719F565872E7C739A9058BA2

Function 10003340 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,10018648,000000FF), ref: 1000337E
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,10018648,000000FF), ref: 100033BD
SetEvent.KERNEL32(?), ref: 100033CF
LeaveCriticalSection.KERNEL32(?), ref: 100033D2

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalEventSection$EnterLeave
String ID:
API String ID: 2034477713-0
Opcode ID: 26d7926c99e25f810d7718daa53f3b713310baac375bc8a9718a81a7c18c5246
Instruction ID: e5964f4e11a61a5ceb4984cd574a80e3950d02b8ad30e80ede868aa41323114b
Opcode Fuzzy Hash: 26d7926c99e25f810d7718daa53f3b713310baac375bc8a9718a81a7c18c5246
Instruction Fuzzy Hash: A5119D71504B44DFD321CF25C884B5BB7E8FB48260F008A2AE49A83A90DB79FA44CB91

Function 10017DE0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(10020168,?,?,1001533B), ref: 10017DFF
LeaveCriticalSection.KERNEL32(10020168,?,1001533B), ref: 10017E29
_malloc.LIBCMT ref: 10017E33

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CriticalSection$EnterLeave_malloc
String ID:
API String ID: 4242827099-0
Opcode ID: d9080a10b4345808967dd27d92c9b69f056f69c068306372603454a2a88374c5
Instruction ID: 61feaa6bcb75b8102a09506a810e75e671a35ffd5e85a93e1235847fc3054c73
Opcode Fuzzy Hash: d9080a10b4345808967dd27d92c9b69f056f69c068306372603454a2a88374c5
Instruction Fuzzy Hash: 66118276A002138BD755CB2CFD4199673F6FFD42A035582BEE80DCB225EA31DC918B80

Function 00403B8A Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00402546: __amsg_exit.LIBCMT ref: 00402554

__amsg_exit.LIBCMT ref: 00403BB6
__lock.LIBCMT ref: 00403BC6
InterlockedDecrement.KERNEL32(?), ref: 00403BE3
InterlockedIncrement.KERNEL32(009316C0), ref: 00403C0E

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
Instruction ID: 4c552d2baa94243f91659daba1be32444af7e91f1612fcd78746f7470628c05b
Opcode Fuzzy Hash: 52a3e7971e82fb72f830ee4ccc85c939e43fcece51e1a5e76106840384332467
Instruction Fuzzy Hash: 8B01A532900721ABD711BF269906B5ABF74AB00759F14403BE800772D2CB7CAE81DB9E

Function 1000F24D Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1000AB6E: __amsg_exit.LIBCMT ref: 1000AB7C

__amsg_exit.LIBCMT ref: 1000F279
__lock.LIBCMT ref: 1000F289
InterlockedDecrement.KERNEL32(?), ref: 1000F2A6
InterlockedIncrement.KERNEL32(00BF16B8), ref: 1000F2D1

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 688ec18e88f5c39b8294586d72f857720aa36dea6ca6f4b7078c97f8e49bdce4
Instruction ID: fffc615c0fb4f66862dac9a19bb85b947d9e820b5dc1b207d8f39025125812c1
Opcode Fuzzy Hash: 688ec18e88f5c39b8294586d72f857720aa36dea6ca6f4b7078c97f8e49bdce4
Instruction Fuzzy Hash: AE01923AD01762ABFB11DB64884576DB3A0FF057E0F118109F80067A89CB38BD81EBD5

Function 004024CF Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040199A), ref: 004024D1

Part of subcall function 004023A1: TlsGetValue.KERNEL32(?,004024E4,?,?,0040199A), ref: 004023A8
Part of subcall function 004023A1: TlsSetValue.KERNEL32(00000000,004024E4,?,?,0040199A), ref: 004023C9

__calloc_crt.LIBCMT ref: 004024F3

Part of subcall function 00404107: __calloc_impl.LIBCMT ref: 00404115
Part of subcall function 00404107: Sleep.KERNEL32(00000000), ref: 0040412C

Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000000,004023BF,?,004024E4,?,?,0040199A), ref: 00402337
Part of subcall function 0040232A: TlsGetValue.KERNEL32(00000006,?,004024E4,?,?,0040199A), ref: 0040234E

Part of subcall function 00402410: GetModuleHandleA.KERNEL32(KERNEL32.DLL,00409438,0000000C,00402521,00000000,00000000,?,?,0040199A), ref: 00402421
Part of subcall function 00402410: GetProcAddress.KERNEL32(?,EncodePointer), ref: 00402455
Part of subcall function 00402410: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402465
Part of subcall function 00402410: InterlockedIncrement.KERNEL32(0040A460), ref: 00402487
Part of subcall function 00402410: __lock.LIBCMT ref: 0040248F
Part of subcall function 00402410: ___addlocaleref.LIBCMT ref: 004024AE

GetCurrentThreadId.KERNEL32 ref: 00402523
SetLastError.KERNEL32(00000000,?,?,0040199A), ref: 0040253B

Memory Dump Source

Source File: 0000001F.00000002.2549710270.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001F.00000002.2549683761.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549768287.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549800945.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001F.00000002.2549832965.000000000040C000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_400000_nfregdrv.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
Instruction ID: 6e150c00b90b0de194aaa4e6d30466842cabbf0b81775d3192f362ebb9054922
Opcode Fuzzy Hash: 5ab9714a243f0ffc41694fcd0ac968f58e359ad798ea549c5e95678d0f806d4d
Instruction Fuzzy Hash: B3F0F432000621AAC63227757E0D64B2B50AF50775B21413EF985B61E1CEB88940869D

Function 1000AAF7 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,00000000,10009235,1000A326,00000001,1000A856,00000000,00000000,00000001,?,?,?,1000A968,?,1000ACF2,00000000), ref: 1000AAF9

Part of subcall function 1000A9B0: TlsGetValue.KERNEL32(00000000,1000AB0C,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000A9B7
Part of subcall function 1000A9B0: TlsSetValue.KERNEL32(00000000,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27), ref: 1000A9D8

__calloc_crt.LIBCMT ref: 1000AB1B

Part of subcall function 1000B195: __calloc_impl.LIBCMT ref: 1000B1A3
Part of subcall function 1000B195: Sleep.KERNEL32(00000000), ref: 1000B1BA

Part of subcall function 1000A91E: TlsGetValue.KERNEL32(?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001,?,?,1001B608), ref: 1000A92B
Part of subcall function 1000A91E: TlsGetValue.KERNEL32(00000002,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27,00000001), ref: 1000A942

Part of subcall function 1000AA38: GetModuleHandleA.KERNEL32(KERNEL32.DLL,1001B668,0000000C,1000AB49,00000000,00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000), ref: 1000AA49
Part of subcall function 1000AA38: GetProcAddress.KERNEL32(?,EncodePointer), ref: 1000AA7D
Part of subcall function 1000AA38: GetProcAddress.KERNEL32(?,DecodePointer), ref: 1000AA8D
Part of subcall function 1000AA38: InterlockedIncrement.KERNEL32(1001E5E0), ref: 1000AAAF
Part of subcall function 1000AA38: __lock.LIBCMT ref: 1000AAB7
Part of subcall function 1000AA38: ___addlocaleref.LIBCMT ref: 1000AAD6

GetCurrentThreadId.KERNEL32 ref: 1000AB4B
SetLastError.KERNEL32(00000000,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000AB63

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 47baad0c142978dd281d06efe9ff58a8f45b381e9549035b39ead8b204b2342f
Instruction ID: 6fb4e631f38a478814a727dc28711fd6a3486464b3ce86ddb14d750e3725a89c
Opcode Fuzzy Hash: 47baad0c142978dd281d06efe9ff58a8f45b381e9549035b39ead8b204b2342f
Instruction Fuzzy Hash: 0BF028329016325EF726AB746C09B9E3A91DF067F07118318F540D70E5CF34DC808690

Function 10013A80 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 10013A8F
CloseHandle.KERNEL32(00000000), ref: 10013AB5
GetModuleFileNameExW.PSAPI(00000000,00000000,?,?), ref: 10013ACD
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?), ref: 10013AD5

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$FileModuleNameOpenProcess
String ID:
API String ID: 3706008839-0
Opcode ID: 77a01a2355183141ac97614d7ed4b7053512745596251045c5cd6b166a56d9cf
Instruction ID: 9d03786ab276ef560676e71944a6f241f9687970605c8b5740b5995641b249e1
Opcode Fuzzy Hash: 77a01a2355183141ac97614d7ed4b7053512745596251045c5cd6b166a56d9cf
Instruction Fuzzy Hash: BEF090363042216FE211CB6AEC88D6F37EDEFC9A11B054818F544C3200DA30DC0AC6B2

Function 10013AE0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 10013AEF
CloseHandle.KERNEL32(00000000), ref: 10013B15
GetModuleFileNameExA.PSAPI(00000000,00000000,?,?), ref: 10013B2D
CloseHandle.KERNEL32(00000000,00000000,00000000,?,?), ref: 10013B35

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: CloseHandle$FileModuleNameOpenProcess
String ID:
API String ID: 3706008839-0
Opcode ID: 8cc178218c7d8c3221216592da3333f16c171a7615b685b5cff0377258111b15
Instruction ID: 8e40d057b3745753bf0ea22a452f5ad3ee9e323a75b10f58dd7a4a987a81d136
Opcode Fuzzy Hash: 8cc178218c7d8c3221216592da3333f16c171a7615b685b5cff0377258111b15
Instruction Fuzzy Hash: 00F06D763053616BE211DB29EC88E6B37A9EBC9A11B054919F604C3200DB30EC4AC6B1

Function 10007DB3 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1000A9B0: TlsGetValue.KERNEL32(00000000,1000AB0C,?,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001), ref: 1000A9B7
Part of subcall function 1000A9B0: TlsSetValue.KERNEL32(00000000,?,?,1000A968,?,1000ACF2,00000000,00000000,10008BC3,00000000,?,?,00000001,?,?,10008C27), ref: 1000A9D8

Part of subcall function 1000A995: TlsGetValue.KERNEL32(?,10007DC4,00000000), ref: 1000A99F

GetLastError.KERNEL32(00000000,?,00000000), ref: 10007DDC
ExitThread.KERNEL32 ref: 10007DE3
GetCurrentThreadId.KERNEL32 ref: 10007DE9
__freefls@4.LIBCMT ref: 10007E0A

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast__freefls@4
String ID:
API String ID: 3657912857-0
Opcode ID: 64a50246a69103428987866c6c5c24afc67ad888acb03d37522b74bef4819570
Instruction ID: 77834a4035ff60ce0f3138a5f24efa19d5a290510d67734f4d47669ef0895791
Opcode Fuzzy Hash: 64a50246a69103428987866c6c5c24afc67ad888acb03d37522b74bef4819570
Instruction Fuzzy Hash: CC01D67C9016519FF305EB70CC48A4E37F9FF492C0B228569F9098712ADB38E882CB52

Function 10007AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10007AF7
__CxxThrowException@8.LIBCMT ref: 10007B29

Part of subcall function 10008D7B: RaiseException.KERNEL32(?,?,10008876,?,?,?,?,?,10008876,?,1001BB8C,1001F1E4), ref: 10008DBB

Strings

invalid string position, xrefs: 10007AFC

Memory Dump Source

Source File: 0000001F.00000002.2550295392.0000000010001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 10000000, based on PE: true

Associated: 0000001F.00000002.2550268574.0000000010000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550330909.0000000010019000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550369185.000000001001E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000001F.00000002.2550398740.0000000010022000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_10000000_nfregdrv.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 65eb9927a461a61c6ced63933107e4e21b974b836ce3081774b1cc0b4902cc7c
Instruction ID: d17f9ad7a6bda8f05d9bf2ec8c2e610a9defb4f0618d30455176f24681aaa848
Opcode Fuzzy Hash: 65eb9927a461a61c6ced63933107e4e21b974b836ce3081774b1cc0b4902cc7c
Instruction Fuzzy Hash: E1E0E275900458ABEB00DBD4CC45BDEB778FB18350F400129E245BB48AEFB8A688CB61

Analysis Process: FastestVPN.WindowsService.exePID: 7136, Parent PID: 5664COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	1

Executed Functions

Function 00D31F08 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 00D31F89

Memory Dump Source

Source File: 00000023.00000002.2760848600.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_d30000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 0582a7188d222c0f65f5e9cff918e9afc94cccdb4cfc83654749c89ad3692719
Instruction ID: 38a2b558fcc307fea8696abf730b3768a1362ba7cdde3deb46f2758f405adbe5
Opcode Fuzzy Hash: 0582a7188d222c0f65f5e9cff918e9afc94cccdb4cfc83654749c89ad3692719
Instruction Fuzzy Hash: BF2114B69002098FCB14CF9AC884ADEFBB5AF58310F14852EE419A7200C375A905CBA0

Function 00D314E0 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 00D31F89

Memory Dump Source

Source File: 00000023.00000002.2760848600.0000000000D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_d30000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7c1199d60436420704df4a2da803dde746f05d551e21ff1ac514930143a725ce
Instruction ID: 08010c738411f412e5bdd61caecb04a11a10ae8311b295c281a037217f217214
Opcode Fuzzy Hash: 7c1199d60436420704df4a2da803dde746f05d551e21ff1ac514930143a725ce
Instruction Fuzzy Hash: 0F21F3BA90070A9FCB14CF9AC884A9EFBF5FF48310F14852AE519A7200D375A944CBA4

Analysis Process: powershell.exePID: 3792, Parent PID: 3292COMMON

Executed Functions

Function 02E2A528 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6fe7ef87c9b775ef13eacfad847deb674a531931a82631dbacd0dcc25a7583
Instruction ID: d12dde6af89bb815d0383a876ff7a92b99c402ce11844a7104ecf8ca63208841
Opcode Fuzzy Hash: 1d6fe7ef87c9b775ef13eacfad847deb674a531931a82631dbacd0dcc25a7583
Instruction Fuzzy Hash: 3DB14E70E402199FDB14CFA9C98579EBBF2AF88318F14D139D816A7354EB74984ACF81

Function 02E2ADF8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61844d4689e619d2a41cb29f5a31e965dce417c831f203a1d30b34aa80b35f18
Instruction ID: e8b77416210bdc2eeca6d1d834d5ef9624bfcc2c286a165b19149f875f853833
Opcode Fuzzy Hash: 61844d4689e619d2a41cb29f5a31e965dce417c831f203a1d30b34aa80b35f18
Instruction Fuzzy Hash: 67B14F71E402298FDB14CFA9C88579DBBF2BF48318F14D129E816E7354EB749889CB81

Function 02E26A30 Relevance: 4.3, Strings: 3, Instructions: 521COMMON

Download Yara Rule

Strings

$cq, xrefs: 02E26FAF
$cq, xrefs: 02E26C4A
Hgq, xrefs: 02E26AF6

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID: Hgq$$cq$$cq
API String ID: 0-2948965698
Opcode ID: 88cbdfce35e93480856ef3cf8bd4ba54569b5056a2a11ba0adb3205a33b8c180
Instruction ID: c10115f483552eb3603d5849fcd09e771ea1a1bda4631f9b9f96be8e891275ec
Opcode Fuzzy Hash: 88cbdfce35e93480856ef3cf8bd4ba54569b5056a2a11ba0adb3205a33b8c180
Instruction Fuzzy Hash: 91225F34B002248FCB25DB64C8547AEBBB6BF89304F1494E9D50AAB3A1CF359D85CF91

Function 02E2A51E Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb02b1f04ff1525acdcdce29d40f30f424c0bcb25a8ba6dcb45a961fe3fd4c6
Instruction ID: 80c81d3cf84c2229c3dc403181462e861c448fb710af377a595be1b40c5aa5be
Opcode Fuzzy Hash: eeb02b1f04ff1525acdcdce29d40f30f424c0bcb25a8ba6dcb45a961fe3fd4c6
Instruction Fuzzy Hash: B2B14A70E402299FDB14CFA8C98579EBBF2AF48318F14D139D816A7354EB74984ACF81

Function 02E2ADEC Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1f5314dcfde88637989ef286bf32ab1d26e5f2a86058fd3f5e73a542ef086e
Instruction ID: fdcaa016440efbbe846a6691d80d8b115f3693a6790e7b3533ec4b18c5e098ea
Opcode Fuzzy Hash: 5d1f5314dcfde88637989ef286bf32ab1d26e5f2a86058fd3f5e73a542ef086e
Instruction Fuzzy Hash: DBB13DB1E40229CFDB10CFA9C98579DBBF1BF48318F14D129E816A7354EB749889CB91

Function 02E229F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540f6ce6040c664272a8f7509688ec9e7ab3c70750611d8327306a66b93bd880
Instruction ID: 010db993de8475488d062962350befba2ff0cf8abe65370bf2f7c76de097346c
Opcode Fuzzy Hash: 540f6ce6040c664272a8f7509688ec9e7ab3c70750611d8327306a66b93bd880
Instruction Fuzzy Hash: AD919FB0A006058FCB15CF58C4D4AEEFBB1FF88314B249659D916AB3A5C735EC55CBA0

Function 02E2AB64 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a88e7ea794ab6b06d3ac9d1f2d50de661ec65f47ba6a98d44923ce8c1eea80
Instruction ID: 58639fc9a6199e5959deeaf332c0d737e555e76f77f563f4d0ecf68de7913b78
Opcode Fuzzy Hash: 00a88e7ea794ab6b06d3ac9d1f2d50de661ec65f47ba6a98d44923ce8c1eea80
Instruction Fuzzy Hash: D37139B0E002599FDB14CFA9C8857DEBBF2EF88318F14D129E416A7354EB749846CB91

Function 02E2AB70 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b212a1330557b97b6784bdd0b16dfacc71fd35cf30b9f0469bb12fb614adfb
Instruction ID: fb1bb71fc44eb8acdde331951272ba938f19f30386d1081dd973921729db1179
Opcode Fuzzy Hash: a4b212a1330557b97b6784bdd0b16dfacc71fd35cf30b9f0469bb12fb614adfb
Instruction Fuzzy Hash: 5D7149B0E002199FDB14CFA9C8857DEBBF2EF88318F14D129E416A7354EB749849CB91

Function 02E22B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e212756674fdfc619bd158d8b67876dab2f1330728abef5ac57572bfcaf07272
Instruction ID: 98ac6e1b181c054597bddfe7c6da3ee8142da4a4e7aa4d85e33271637189a7ab
Opcode Fuzzy Hash: e212756674fdfc619bd158d8b67876dab2f1330728abef5ac57572bfcaf07272
Instruction Fuzzy Hash: EB4169B0A005158FCB05CF58C4D8AEEFBB1FF48314B259159C956AB364C732EC95CBA0

Function 02E276E8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04e91be0e84069393c7857cfb6a7c4fa3d6a25d5e5f4584c6af615963e08c38
Instruction ID: e3d51e38b32c5d41db309fef8b447fe36fd54e67cc5265df3b4caa299abd2bf3
Opcode Fuzzy Hash: c04e91be0e84069393c7857cfb6a7c4fa3d6a25d5e5f4584c6af615963e08c38
Instruction Fuzzy Hash: 6931FD30A011288FCB25DF64C8547EEBBB2BF49308F1454E9D50AAB351CB359E85CF95

Function 02E2A813 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4281a1554becd1b67b0dd6c7c17f6b7a8cc3b15569cb351f3921bc2bfac58228
Instruction ID: 32422691f10f37b4b8145cac6aa37fc4feac1899ac5d7f53e63e6251c8223ae7
Opcode Fuzzy Hash: 4281a1554becd1b67b0dd6c7c17f6b7a8cc3b15569cb351f3921bc2bfac58228
Instruction Fuzzy Hash: 7D11A430D94169DBDF38DA94D99C7ECB772AB4531DF14B43AC002B6290AB74588ECF92

Function 02D2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2607629908.0000000002D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468a0ba455970bbfd2a3091e785bbc393843754e13ede34c7d5a8ed770b80160
Instruction ID: f876c345f1fc158585cd07383916249a8a9346a1ebb72b9365823cf9f50607c6
Opcode Fuzzy Hash: 468a0ba455970bbfd2a3091e785bbc393843754e13ede34c7d5a8ed770b80160
Instruction Fuzzy Hash: 67012B710043509AE7208B15CEC4767BF98DF51338F28C519EC484B356C379DD49C6B1

Function 02D2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2607629908.0000000002D2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2d2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b39415874beb45c7175d9dab62291d0fff012ec7d4286e5267ca0362659fbdd
Instruction ID: 34f306b326d7be0b270701306bc17760ad84862557044aab485480545750e5dc
Opcode Fuzzy Hash: 7b39415874beb45c7175d9dab62291d0fff012ec7d4286e5267ca0362659fbdd
Instruction Fuzzy Hash: 9A01407200E3C05FE7128B258994752BFB4DF57224F19C1DBD8888F2A7C2695C49C772

Non-executed Functions

Function 02E2106A Relevance: 6.3, Strings: 5, Instructions: 75COMMON

Download Yara Rule

Strings

p, xrefs: 02E210C2
p, xrefs: 02E210B2
p, xrefs: 02E210D2
p, xrefs: 02E21072
p, xrefs: 02E21062

Memory Dump Source

Source File: 00000024.00000002.2608446502.0000000002E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2e20000_powershell.jbxd

Similarity

API ID:
String ID: p$p$p$p$p
API String ID: 0-945622192
Opcode ID: 54ef6c8062fe0408697cace8b7946fa927c12a597478c4ecf83b645d8b08a939
Instruction ID: 11243121bb7db4a4231eee9aec3b0e06e251634c1a589f3d2415c4339720ce2d
Opcode Fuzzy Hash: 54ef6c8062fe0408697cace8b7946fa927c12a597478c4ecf83b645d8b08a939
Instruction Fuzzy Hash: BB21724184E7D23FD3038234A8656D53F609A13294F5952EBC89ACF1E3E50D1A1EC3B2

Analysis Process: FastestVPN.WindowsService.exePID: 6404, Parent PID: 5664COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00CE5A60 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 00CE69D1

Memory Dump Source

Source File: 00000030.00000002.2792393974.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_ce0000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: c9b2f81f2715a700185c23f7bc48075bf1b6cd2e02b96a412d961a7df4109ce4
Instruction ID: 566d74bda9a80abe10fea48aad1e82caf644262187cf8a29581f3f07fb8a1ee4
Opcode Fuzzy Hash: c9b2f81f2715a700185c23f7bc48075bf1b6cd2e02b96a412d961a7df4109ce4
Instruction Fuzzy Hash: E841E4B58093999FCB12DF6DC8906CEBFB0EF59310F15409BC494AB213D3745906CBA5

Function 00CE6951 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 00CE69D1

Memory Dump Source

Source File: 00000030.00000002.2792393974.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_ce0000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 58674497a1ac4241659c29f128633c5bfaccedf49dfabc356a0da35abef91934
Instruction ID: 02e9c1bbddfb62e00682fa222251c00fb986a2fbb7fa102a5cec5bb4693b4001
Opcode Fuzzy Hash: 58674497a1ac4241659c29f128633c5bfaccedf49dfabc356a0da35abef91934
Instruction Fuzzy Hash: 832135B6C102498FCB10CFAAC884ADEFBF5FB98310F14852ED419A7200C375A906CFA1

Function 00CE5A24 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 00CE69D1

Memory Dump Source

Source File: 00000030.00000002.2792393974.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_ce0000_FastestVPN.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: ca984f2cd68024cf2472a7513a27af5737085005a3dda20e1a5d0421a485ba93
Instruction ID: c0818e632f8babe15bbff10cf1cd2b6dd201878b9133d650ceba0b2d45b0658e
Opcode Fuzzy Hash: ca984f2cd68024cf2472a7513a27af5737085005a3dda20e1a5d0421a485ba93
Instruction Fuzzy Hash: F42133B6D103499FCB10DF9AC844ADEFBF5FB98320F14852ED919A7201C3B5A904CBA1

Analysis Process: subinacl.exePID: 6504, Parent PID: 5664COMMON

Executed Functions

Function 010383F6 Relevance: 860.9, APIs: 392, Strings: 98, Instructions: 3425COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010383FB
#540.MFC42U(01001510,00000002,00000000), ref: 01038447
#538.MFC42U(?,01001510,00000002,00000000), ref: 0103845D
#540.MFC42U(?,01001510,00000002,00000000), ref: 0103846C
#540.MFC42U(?,01001510,00000002,00000000), ref: 0103847B
#538.MFC42U(none,?,01001510,00000002,00000000), ref: 0103848F
#2910.MFC42U(00000000), ref: 010384D7
#861.MFC42U(?,none,?,01001510,00000002,00000000), ref: 01038503
#4197.MFC42U(?,none,?,01001510,00000002,00000000), ref: 0103850E
#2755.MFC42U(0000003D,?,none,?,01001510,00000002,00000000), ref: 01038522
#2910.MFC42U(00000000,/display,00000004,0000003D,?,none,?,01001510,00000002,00000000), ref: 01038540
#800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 01038570
#800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103857F
#800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103858E
#800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103859D
#800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 010385AC
#2910.MFC42U(00000000,/noverbose,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/display,00000004,0000003D,?,none,?,01001510), ref: 01038612
#2910.MFC42U(00000000,/confirmtocontinue,00000004,00000000,00000000,/noverbose,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/display,00000004,0000003D), ref: 01038647
#2910.MFC42U(00000000,/ifchangecontinue,00000004,00000000,00000000,/confirmtocontinue,00000004,00000000,00000000,/noverbose,00000004,00000000,00000000,/verbose,00000004,00000000), ref: 01038676
#2910.MFC42U(00000000,/sdsize,00000004,00000000,00000000,/ifchangecontinue,00000004,00000000,00000000,/confirmtocontinue,00000004,00000000,00000000,/noverbose,00000004,00000000), ref: 010386A5
#2910.MFC42U(00000000,/compactsecuritydescriptor,00000004,00000000,00000000,/sdsize,00000004,00000000,00000000,/ifchangecontinue,00000004,00000000,00000000,/confirmtocontinue,00000004,00000000), ref: 010386D4
#2910.MFC42U(00000000,/audit ace count ,00000004,00000000,00000000,/compactsecuritydescriptor,00000004,00000000,00000000,/sdsize,00000004,00000000,00000000,/ifchangecontinue,00000004,00000000), ref: 01038703
#2910.MFC42U(00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000,00000000,/compactsecuritydescriptor,00000004,00000000,00000000,/sdsize,00000004,00000000), ref: 01038723
#2910.MFC42U(00000000,/testmode,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000,00000000,/compactsecuritydescriptor,00000004,00000000), ref: 01038743
#2910.MFC42U(00000000,/apply,00000004,00000000,00000000,/notestmode,00000004,00000000,00000000,/testmode,00000004,00000000,00000000,/perm. ace count ,00000004,00000000), ref: 010387A1
#4124.MFC42U(?,00000000,0000003D,?,none,?,01001510,00000002,00000000), ref: 010387E7
#858.MFC42U(00000000,?,00000000,0000003D,?,none,?,01001510,00000002,00000000), ref: 010387F7
#800.MFC42U(00000000,?,00000000,0000003D,?,none,?,01001510,00000002,00000000), ref: 01038806
#2910.MFC42U(00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?,01001510,00000002,00000000), ref: 01038819
#2910.MFC42U(00000000,/notestmode,00000004,00000000,00000000,/testmode,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000), ref: 01038772

Part of subcall function 010358C5: wcsncmp.MSVCRT ref: 010358E3

#2910.MFC42U(00000000,/verbose,00000004,00000000,00000000,/display,00000004,0000003D,?,none,?,01001510,00000002,00000000), ref: 010385D9

Part of subcall function 010358C5: wcslen.MSVCRT ref: 010358C9

#2910.MFC42U(00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?,01001510,00000002), ref: 0103883A
#2910.MFC42U(00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?), ref: 0103885B
#2755.MFC42U(0000003D,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004,00000000,?,00000000), ref: 01038880
#4272.MFC42U(00000001,00000001,0000003D,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004,00000000), ref: 01038894
#858.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004), ref: 010388A4
#800.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004), ref: 010388B3
#4197.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004), ref: 010388C5
#6563.MFC42U(00000000,00000000,00000001,00000001,0000003D,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=), ref: 010388DD
#2910.MFC42U(00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=,00000004,00000000), ref: 010388F5
#2755.MFC42U(0000003D,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000,00000000,/setowner=), ref: 0103891E
#4272.MFC42U(00000001,00000001,0000003D,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000), ref: 01038932
#858.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004), ref: 01038942
#800.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004), ref: 01038951
#4197.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004), ref: 01038963
#6563.MFC42U(00000000,00000000,00000001,00000001,0000003D,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ), ref: 0103897B
#2910.MFC42U(00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ,00000004,00000000), ref: 010389D7
#2755.MFC42U(0000003D,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000,00000000,/owner ), ref: 01038A00
#4272.MFC42U(00000001,00000001,0000003D,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000), ref: 01038A14
#858.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004), ref: 01038A24
#800.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004), ref: 01038A33
#2910.MFC42U(00000000,sdsize,00000004,00000000,00000001,00000001,0000003D,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000), ref: 01038A4C
#2910.MFC42U(00000000,owner,00000004,00000000,00000000,sdsize,00000004,00000000,00000001,00000001,0000003D,00000000,00000000,/display,00000004,00000000), ref: 01038A6B
#2910.MFC42U(00000000,dacl,00000004,00000000,00000000,owner,00000004,00000000,00000000,sdsize,00000004,00000000,00000001,00000001,0000003D,00000000), ref: 01038A96
#2910.MFC42U(00000000,sacl,00000004,00000000,00000000,dacl,00000004,00000000,00000000,owner,00000004,00000000,00000000,sdsize,00000004,00000000), ref: 01038AC1
#2910.MFC42U(00000000,name,00000004,00000000,00000000,sacl,00000004,00000000,00000000,dacl,00000004,00000000,00000000,owner,00000004,00000000), ref: 01038AE8
#2910.MFC42U(00000000,primarygroup,00000004,00000000,00000000,name,00000004,00000000,00000000,sacl,00000004,00000000,00000000,dacl,00000004,00000000), ref: 01038B13
#2910.MFC42U(00000000,sddl,00000004,00000000,00000000,primarygroup,00000004,00000000,00000000,name,00000004,00000000,00000000,sacl,00000004,00000000), ref: 01038B3E
#2756.MFC42U(minpath,00000000,00000000,sddl,00000004,00000000,00000000,primarygroup,00000004,00000000,00000000,name,00000004,00000000,00000000,sacl), ref: 01038B67
#2910.MFC42U(00000000,minpath=%u,-0000000A), ref: 01038B92
swscanf.MSVCRT ref: 01038B98
#2910.MFC42U(00000000,minpath,00000000,00000000,sddl,00000004,00000000,00000000,primarygroup,00000004,00000000,00000000,name,00000004,00000000,00000000), ref: 01038BC5
#2910.MFC42U(00000000,/audit ace count ,00000004,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000,00000000,/objectexclude=,00000004,00000000), ref: 01038BEC
#2910.MFC42U(00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000,00000000,/display,00000004,00000000,00000000,/pathexclude=,00000004,00000000), ref: 01038C1C
#2910.MFC42U(00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000,00000000,/display,00000004,00000000), ref: 01038C4C
#2755.MFC42U(0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000,00000000,/display), ref: 01038C7C
#4272.MFC42U(00000001,00000001,0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000), ref: 01038C90
#858.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004), ref: 01038CA0
#800.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004), ref: 01038CAF
#825.MFC42U(?,00000000,00000001,00000001,0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ), ref: 01038CCB
#4199.MFC42U(00000000,00000001,00000001,0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004), ref: 01038CDA
#2910.MFC42U(00000000,00000001,010014DC,00000000,00000000,00000001,00000001,0000003D,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004), ref: 01038CFC
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(00000000,00000000,00000001,010014DC), ref: 01038D02
GetLastError.KERNEL32 ref: 01038D5F
GetSecurityDescriptorLength.ADVAPI32(010014DC), ref: 01038D8D
#823.MFC42U(00000000), ref: 01038D96
GetLastError.KERNEL32(ConvertStringSecurityDescriptorToSecurityDescriptor - Allocation Error), ref: 01038DDB
#2910.MFC42U(00000000,00000000), ref: 01038DFF
#2910.MFC42U(00000000), ref: 01038E25
LocalFree.KERNEL32(010014DC), ref: 01038E7B
LocalFree.KERNEL32(010014DC), ref: 01038EAA
GetLastError.KERNEL32(ConvertStringSecurityDescriptorToSecurityDescriptor), ref: 01038EBA
#2910.MFC42U(00000000,00000000), ref: 01038EDE
#2910.MFC42U(00000000), ref: 01038F04
#2910.MFC42U(00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ,00000004,00000000), ref: 01038F6D
#2755.MFC42U(0000003D,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000,00000000,/audit ace count ), ref: 01038F92
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000), ref: 01038FA6
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004), ref: 01038FB6
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004), ref: 01038FC5
#2910.MFC42U(00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ), ref: 01038FD8
_wtoi.MSVCRT(00000000,00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000), ref: 01038FDE
#2910.MFC42U(00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ,00000004,00000000), ref: 01038FFE
#2755.MFC42U(0000003D,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000,00000000,/perm. ace count ), ref: 01039027
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000), ref: 0103903B
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004), ref: 0103904B
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004), ref: 0103905A
#858.MFC42U(00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl), ref: 01039070
GetLastError.KERNEL32(LookupAccountName,-00000012,00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000), ref: 01039090
#2910.MFC42U(00000000,00000000), ref: 010390B4
#2910.MFC42U(00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl,00000004,00000000), ref: 0103913B
#2910.MFC42U(00000000,/primary group ,00000004,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000), ref: 0103915C
#2910.MFC42U(00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000), ref: 0103917D
#2910.MFC42U(00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004,00000000,00000000,/setprimarygroup=,00000004,00000000), ref: 0103919E
#2755.MFC42U(0000003D,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004,00000000,00000000,/setprimarygroup=), ref: 010391C7
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004,00000000), ref: 010391DB
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004), ref: 010391EB
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004), ref: 010391FA
#6278.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004), ref: 01039205
#6279.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004), ref: 01039210
wcscmp.MSVCRT ref: 01039220
#2910.MFC42U(00000000,0x%x,000006BE), ref: 01039243
swscanf.MSVCRT ref: 01039249
#2910.MFC42U(00000000,/pace ,00000004,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000,00000000,/primary group ,00000004,00000000), ref: 010392B3
#2910.MFC42U(00000000,/aace ,00000004,00000000,00000000,/pace ,00000004,00000000,00000000,/control,00000004,00000000,00000000,/primarygroup=,00000004,00000000), ref: 010392D4
#2910.MFC42U(00000000,/delaace ,00000004,00000000,00000000,/aace ,00000004,00000000,00000000,/pace ,00000004,00000000,00000000,/control,00000004,00000000), ref: 010392F5
#2910.MFC42U(00000000,/delpace ,00000004,00000000,00000000,/delaace ,00000004,00000000,00000000,/aace ,00000004,00000000,00000000,/pace ,00000004,00000000), ref: 01039316
#2910.MFC42U(00000000,/grant,00000004,00000000,00000000,/delpace ,00000004,00000000,00000000,/delaace ,00000004,00000000,00000000,/aace ,00000004,00000000), ref: 01039337
#2910.MFC42U(00000000,/deny,00000004,00000000,00000000,/grant,00000004,00000000,00000000,/delpace ,00000004,00000000,00000000,/delaace ,00000004,00000000), ref: 01039358
#2910.MFC42U(00000000,/sgrant,00000004,00000000,00000000,/deny,00000004,00000000,00000000,/grant,00000004,00000000,00000000,/delpace ,00000004,00000000), ref: 01039379
#2910.MFC42U(00000000,/sdeny,00000004,00000000,00000000,/sgrant,00000004,00000000,00000000,/deny,00000004,00000000,00000000,/grant,00000004,00000000), ref: 0103939A
#2910.MFC42U(00000000,/sallowdeny,00000004,00000000,00000000,/sdeny,00000004,00000000,00000000,/sgrant,00000004,00000000,00000000,/deny,00000004,00000000), ref: 010393BB
#2910.MFC42U(00000000,/replace=,00000004,00000000,00000000,/sallowdeny,00000004,00000000,00000000,/sdeny,00000004,00000000,00000000,/sgrant,00000004,00000000), ref: 010393DC
#2910.MFC42U(00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004,00000000,00000000,/sallowdeny,00000004,00000000,00000000,/sdeny,00000004,00000000), ref: 010393FD
#2910.MFC42U(00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004,00000000,00000000,/sallowdeny,00000004,00000000), ref: 0103941E
#2755.MFC42U(0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004,00000000,00000000,/sallowdeny), ref: 01039440
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004,00000000), ref: 0103945D
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004), ref: 0103946D
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004), ref: 0103947C
#540.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004), ref: 01039487
#540.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004), ref: 01039496
#2755.MFC42U(0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=), ref: 010394A7
#858.MFC42U(00000000,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000), ref: 010394C0
#861.MFC42U(010014DC,00000000,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000), ref: 010394D0
#4272.MFC42U(00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000), ref: 010394E8
#858.MFC42U(00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004), ref: 010394F8
#800.MFC42U(00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004), ref: 01039507
#4124.MFC42U(00000000,00000000,00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000,00000000), ref: 0103951A
#858.MFC42U(00000000,00000000,00000000,00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000), ref: 0103952A
#800.MFC42U(00000000,00000000,00000000,00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=,00000004,00000000), ref: 01039539
#2910.MFC42U(00000000,00000063,00000000,00000000,00000000,00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D,00000000,00000000,/accesscheck=), ref: 01039555
wcscmp.MSVCRT ref: 01039572
#2910.MFC42U(00000000), ref: 01039585
#2910.MFC42U(00000000,00000000,?,00000003,00000000,-0000000A), ref: 010395A0
LogonUserW.ADVAPI32(00000000,00000000,00000000,?,00000003,00000000), ref: 010395A6
GetLastError.KERNEL32(LogonUser), ref: 010395B9
#2910.MFC42U(00000000,00000000), ref: 010395DD
#2910.MFC42U(00000000), ref: 01039603
#800.MFC42U ref: 0103966C
#800.MFC42U ref: 0103967B
#800.MFC42U ref: 0103968F
#800.MFC42U ref: 0103969E
#2910.MFC42U(00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=,00000004,00000000), ref: 010396B6
#2755.MFC42U(0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000,00000000,/replace=), ref: 010396D8
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000), ref: 010396EC
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004), ref: 010396FC
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004), ref: 0103970B
#858.MFC42U(00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=), ref: 01039728
#861.MFC42U(s-1-1-0,00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000), ref: 01039738
#861.MFC42U(s-1-5-32-545,00000056,s-1-1-0,00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004), ref: 01039756
GetLastError.KERNEL32(LookupAccountName,-00000012,00000096,s-1-5-32-545,00000056,s-1-1-0,00000000,00000000,00000000,00000001,0000003D,00000000,00000000,/suppresssid=,00000004,00000000), ref: 01039787
#2910.MFC42U(00000000,00000000), ref: 010397AB
#2910.MFC42U(00000000), ref: 010397E8
#2910.MFC42U(00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=,00000004,00000000), ref: 01039851
#2755.MFC42U(0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000,00000000,/accountmigration=), ref: 01039873
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000), ref: 01039887
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004), ref: 01039897
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004), ref: 010398A6
#2755.MFC42U(0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=), ref: 010398BA
#538.MFC42U(continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000), ref: 010398D0
#4272.MFC42U(00000000,00000100,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004), ref: 010398F7
#858.MFC42U(00000000,00000000,00000100,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=), ref: 01039907
#800.MFC42U(00000000,00000000,00000100,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=), ref: 01039916
#4124.MFC42U(00000000,000000FF,00000000,00000000,00000100,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000), ref: 0103992E
#858.MFC42U(00000000,00000000,000000FF,00000000,00000000,00000100,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004), ref: 0103993E
#800.MFC42U(00000000,00000000,000000FF,00000000,00000000,00000100,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004), ref: 0103994D
#2910.MFC42U(00000000,stop,00000001,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=), ref: 01039960
#2910.MFC42U(00000000,continue,00000001,00000000,00000000,stop,00000001,continue,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/findsid=), ref: 01039989
#858.MFC42U(00000000,00000000,00000000,continue,00000001,00000000,00000000,stop,00000001,continue,0000003D,00000000,00000000,00000001,0000003D,00000000), ref: 010399BA
GetLastError.KERNEL32(LookupAccountName,-00000012,00000000,00000000,00000000,continue,00000001,00000000,00000000,stop,00000001,continue,0000003D,00000000,00000000,00000001), ref: 010399DA
#2910.MFC42U(00000000,00000000), ref: 010399FE
#2910.MFC42U(00000000), ref: 01039A40
#2910.MFC42U(00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=,00000004,00000000), ref: 01039AFA
#2755.MFC42U(0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000,00000000,/accesscheck=), ref: 01039B1C
#4272.MFC42U(00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004,00000000), ref: 01039B30
#858.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004), ref: 01039B40
#800.MFC42U(00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=,00000004), ref: 01039B4F
#2755.MFC42U(0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000,00000000,/suppresssid=), ref: 01039B69
#4272.MFC42U(?,00000001,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000), ref: 01039B8A
#4124.MFC42U(00000000,00000000,?,00000001,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=), ref: 01039BD3
#858.MFC42U(00000000,00000000,00000000,?,00000001,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000), ref: 01039BE3
#800.MFC42U(00000000,00000000,00000000,?,00000001,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000), ref: 01039BF2
#4197.MFC42U(00000000,00000000,00000000,?,00000001,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000), ref: 01039C2F
#2910.MFC42U(00000000,owner,00000004,00000000,00000000,00000000,?,00000001,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=), ref: 01039C44
#2910.MFC42U(00000000,dacl,00000004,00000000,00000000,owner,00000004,00000000,00000000,00000000,?,00000001,0000003D,00000000,00000000,00000001), ref: 01039C6F
#2910.MFC42U(00000000,sacl,00000004,00000000,00000000,dacl,00000004,00000000,00000000,owner,00000004,00000000,00000000,00000000,?,00000001), ref: 01039C97
#800.MFC42U(00000000,00000000,all,00000004,00000000,00000000,primarygroup,00000004,00000000,00000000,sacl,00000004,00000000,00000000,dacl,00000004), ref: 01039CFE
#537.MFC42U(0100B25E,?,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=,00000004,00000000), ref: 01039D2C
#800.MFC42U(?,00000001,0100B25E,?,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004,00000000,00000000,/findsid=), ref: 01039D50
GetComputerNameW.KERNEL32(?,00000000), ref: 01039D73
#861.MFC42U(?), ref: 01039D83
#927.MFC42U(00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=,00000004), ref: 01039D9C
#858.MFC42U(00000000,00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=), ref: 01039DAC
#800.MFC42U(00000000,00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000,00000001,0000003D,00000000,00000000,/cleandeletedsidsfrom=), ref: 01039DBB
#538.MFC42U(01003608,00000001,00000000,00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000,00000001,0000003D,00000000), ref: 01039DDD
#922.MFC42U(?,00000000,00000000,01003608,00000001,00000000,00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000), ref: 01039DF4
#800.MFC42U(?,00000000,00000000,01003608,00000001,00000000,00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000), ref: 01039E03
#800.MFC42U(?,00000000,00000000,01003608,00000001,00000000,00000000,01003608,?,?,00000001,0100B25E,?,0000003D,00000000,00000000), ref: 01039E12
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,01003608,00000001,00000000,00000000,01003608,?,?,00000001,0100B25E,?), ref: 01039E20
#2910.MFC42U(00000000,000004B2,00000000,00000000,00000000,00000000,?,00000000,00000000,01003608,00000001,00000000,00000000,01003608,?,?), ref: 01039E34
#2910.MFC42U(00000000,00000000,Error finding domain name,00000000,00000000,00000000,00000000,000004B2,00000000,00000000,00000000,00000000,?,00000000,00000000,01003608), ref: 01039E83
#800.MFC42U ref: 01039EF3
#2910.MFC42U(00000000,0000001E,00000000,00000000,00000000,00000000,000004B2,00000000,00000000,00000000,00000000,?,00000000,00000000,01003608,00000001), ref: 01039F0C
wcsncpy.MSVCRT ref: 01039F19
#861.MFC42U(s-1-1-0), ref: 01039F2D
#861.MFC42U(s-1-5-32-545,00000056,s-1-1-0), ref: 01039F4D
#800.MFC42U(-00000092,s-1-5-32-545,00000056,s-1-1-0), ref: 01039F6A
#2910.MFC42U(00000000,00000000,00000000,000004B2,00000000,00000000,00000000,00000000,?,00000000,00000000,01003608,00000001,00000000,00000000,01003608), ref: 01039E41

Part of subcall function 0101C94A: __EH_prolog.LIBCMT ref: 0101C94F
Part of subcall function 0101C94A: #540.MFC42U(?,?,0101C9FE,00000000), ref: 0101C967

#2755.MFC42U(0000003D,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000,00000000,/sddl), ref: 0103B54F
#4272.MFC42U(?,00000001,0000003D,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004,00000000), ref: 0103B563
#858.MFC42U(00000000,?,00000001,0000003D,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004), ref: 0103B573
#800.MFC42U(00000000,?,00000001,0000003D,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose,00000004), ref: 0103B582
#858.MFC42U(00000000,00000000,?,00000001,0000003D,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000,00000000,/verbose), ref: 0103B598
GetLastError.KERNEL32(LookupAccountName,-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setprimarygroup=,00000004,00000000,00000000,/revoke,00000004,00000000), ref: 0103B5B8
#2910.MFC42U(00000000,00000000), ref: 0103B5DC
#2755.MFC42U(0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?,01001510,00000002,00000000), ref: 0103B66D
#4272.MFC42U(?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?,01001510,00000002), ref: 0103B681
#858.MFC42U(00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?,01001510), ref: 0103B691
#800.MFC42U(00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?,01001510), ref: 0103B6A0
#858.MFC42U(00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none,?), ref: 0103B6BD
GetLastError.KERNEL32(LookupAccountName,-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?), ref: 0103B6DD
#2910.MFC42U(00000000,00000000), ref: 0103B701

Strings

/findsid=, xrefs: 01039845
/noverbose, xrefs: 01038606
/sallowdeny, xrefs: 010393AF, 0103AD21, 0103AE93
/applyonly: You need to specify at least one value with this option /applyonly=dacl,sacl,owner,group, xrefs: 0103A09B
--- DEBUG ConvertStringSecurityDescriptorToSecurityDescriptorW result GetLastError = , xrefs: 01038D4F
Unknown message , xrefs: 01038E5C, 01038E63, 01038F3B, 01038F42, 01039109, 01039110, 0103963A, 01039641, 0103981F, 01039826, 01039A76, 01039A7D, 01039EC1, 01039EC8, 0103A87F, 0103A886, 0103A945, 0103A94C, 0103ABC1, 0103ABC8, 0103ACB1, 0103ACB8, 0103AF76, 0103AF7D, 0103B453, 0103B45A, 0103B632, 0103B639, 0103B76D, 0103B774
/display, xrefs: 01038534, 010389CB
FindSid : Invalid value , xrefs: 01039ABC
--- DEBUG Avant mask = , xrefs: 0103B133
/suppresssid=, xrefs: 010396AA
Access is not valid, xrefs: 0103B21C
--- DEBUG ValidParameter cobj.GetObjectName().GetBuffer(0) = , xrefs: 010384BD
: , xrefs: 010395EE, 010397BC, 01039E94, 0103A852, 0103A90A, 0103A90F, 0103A935, 0103AB58, 0103AC4E, 0103AF13, 0103B3F0, 0103B729, 0103B72E, 0103B744
/accesscheck=, xrefs: 01039412
/ifchangecontinue, xrefs: 0103866A
--- DEBUG CLEANDELETEDSIDSFROM parsing part = , xrefs: 01039BA3
type=0x%x flags=0x%x accessmask=0x%x, xrefs: 0103B48C
/perm. ace count , xrefs: 01038717, 01038C10
--- DEBUG Apres mask = , xrefs: 0103B171
sacl, xrefs: 01038AB5, 01039C8B, 0103A047
name, xrefs: 01038ADC
/primary group , xrefs: 01039150
/primarygroup=, xrefs: 01039171
/accountmigration=, xrefs: 010393F1, 0103AABA
/applyonly, xrefs: 01039FBE
Both, xrefs: 0103A64A
stop, xrefs: 01039954
: setowner , xrefs: 0103B712
dacl, xrefs: 01038A8A, 01039C63, 0103A02D
sdsize, xrefs: 01038A3D
none, xrefs: 01038480
/objectcopysecurity, xrefs: 0103A1C7
option is invalid, xrefs: 010389AC
/cleandeletedsidsfrom=, xrefs: 01039AEE
/pace , xrefs: 010392A7, 0103B225
: Revoke : , xrefs: 010390C5
LogonUser, xrefs: 010395B4
Parsing Mapping account file error, xrefs: 0103A8D0
/audit ace count , xrefs: 010386F7, 01038BE0
p, xrefs: 0103B19E
: SDDL : , xrefs: 01038E10, 01038EEF
/pathcopysecurity, xrefs: 0103A0C3
/testmode, xrefs: 01038737
This object cannot be container. , xrefs: 01038998
sddl, xrefs: 01038B32
/control, xrefs: 01039192
s-1-5-32-545, xrefs: 0103974B, 01039F42
/owner , xrefs: 0103882E
/grant, xrefs: 0103932B, 0103ACD7
/sdsize, xrefs: 01038699
/revoke, xrefs: 01038FF2
/apply, xrefs: 01038795
Error finding domain name, xrefs: 01039E5A, 0103A81E
owner, xrefs: 01038A5F, 01039C38, 0103A05F
all, xrefs: 01039CD7
/deny, xrefs: 0103934C
--- DEBUG Parsing Mapping File : File is = , xrefs: 0103A67A
/notestmode, xrefs: 01038766
/pathexclude=, xrefs: 010388E9, 010389A2
p, xrefs: 0103B1A5
/verbose, xrefs: 010385CD, 01038F61
type=0x, xrefs: 0103B2FF
--- DEBUG ConvertStringSecurityDescriptorToSecurityDescriptorW Size = , xrefs: 01038DAF
/compactsecuritydescriptor, xrefs: 010386C8
/setowner=, xrefs: 0103880D
/sgrant, xrefs: 0103936D, 0103ACF4, 0103AE3A
--- DEBUG CLEANDELETEDSIDSFROM parsing Domain = , xrefs: 01039C07
: setprimarygroup : , xrefs: 0103B5ED
--- DEBUG ConvertStringSecurityDescriptorToSecurityDescriptorW result bStatus = , xrefs: 01038D1E
/confirmtocontinue, xrefs: 0103863B
/objectexclude=, xrefs: 0103884F
primarygroup, xrefs: 01038B07, 01039CAF
0x%x, xrefs: 01039237
/aace , xrefs: 010392C8, 0103B252
s-1-1-0, xrefs: 0103972D, 01039F22
minpath=%u, xrefs: 01038B85
ConvertStringSecurityDescriptorToSecurityDescriptor - Allocation Error, xrefs: 01038DD6
--- DEBUG Parsing SDCONTROL parameter value = = , xrefs: 01039281
/sdeny, xrefs: 0103938E, 0103AE76
group, xrefs: 0103A077
is not valid. Valid values are : name,sdsize,owner,dacl,sacl,primarygroup,sddl, xrefs: 01038BD4
/changedomain=, xrefs: 01039F7C
continue, xrefs: 010398BF, 0103997D
/migratetodomain=, xrefs: 01039F9D, 0103A43A
/delaace , xrefs: 010392E9
/sddl, xrefs: 01038C40
these editing options are not implemented for this object, xrefs: 0103B1F1
=both, xrefs: 0103A5DC, 0103A5E1, 0103A5F2
minpath, xrefs: 01038B5C
: FindSid : , xrefs: 01039A0F
Format error : , xrefs: 0103B4B4
/replace=, xrefs: 010393D0
--- DEBUG Parsing Mapping File : Method is = , xrefs: 0103A640
ConvertStringSecurityDescriptorToSecurityDescriptor, xrefs: 01038EB5
!, xrefs: 0103AC39
/delpace , xrefs: 0103930A, 0103B27F
LookupAccountName, xrefs: 0103908B, 01039782, 010399D5, 0103AB1E, 0103AC14, 0103AED9, 0103B3B6, 0103B5B3, 0103B6D8
/setprimarygroup=, xrefs: 0103912F

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910$#800$#858$#2755$#4272$ErrorLast$#861$#540$#4124#4197#538$DescriptorSecurity$#6563FreeH_prologLocalswscanfwcscmp$#2756#4199#537#6278#6279#823#825#922#927ComputerConvertLengthLogonNameStringUser_wtoiwcslenwcsncmpwcsncpy
String ID: : $ : FindSid : $ : Revoke : $ : SDDL : $ : setowner $ : setprimarygroup : $ is not valid. Valid values are : name,sdsize,owner,dacl,sacl,primarygroup,sddl$ option is invalid$!$--- DEBUG Apres mask = $--- DEBUG Avant mask = $--- DEBUG CLEANDELETEDSIDSFROM parsing Domain = $--- DEBUG CLEANDELETEDSIDSFROM parsing part = $--- DEBUG ConvertStringSecurityDescriptorToSecurityDescriptorW Size = $--- DEBUG ConvertStringSecurityDescriptorToSecurityDescriptorW result GetLastError = $--- DEBUG ConvertStringSecurityDescriptorToSecurityDescriptorW result bStatus = $--- DEBUG Parsing Mapping File : File is = $--- DEBUG Parsing Mapping File : Method is = $--- DEBUG Parsing SDCONTROL parameter value = = $--- DEBUG ValidParameter cobj.GetObjectName().GetBuffer(0) = $/aace $/accesscheck=$/accountmigration=$/apply$/applyonly$/applyonly: You need to specify at least one value with this option /applyonly=dacl,sacl,owner,group$/audit ace count $/changedomain=$/cleandeletedsidsfrom=$/compactsecuritydescriptor$/confirmtocontinue$/control$/delaace $/delpace $/deny$/display$/findsid=$/grant$/ifchangecontinue$/migratetodomain=$/notestmode$/noverbose$/objectcopysecurity$/objectexclude=$/owner $/pace $/pathcopysecurity$/pathexclude=$/perm. ace count $/primary group $/primarygroup=$/replace=$/revoke$/sallowdeny$/sddl$/sdeny$/sdsize$/setowner=$/setprimarygroup=$/sgrant$/suppresssid=$/testmode$/verbose$0x%x$=both$Access is not valid$Both$ConvertStringSecurityDescriptorToSecurityDescriptor$ConvertStringSecurityDescriptorToSecurityDescriptor - Allocation Error$Error finding domain name$FindSid : Invalid value $Format error : $LogonUser$LookupAccountName$Parsing Mapping account file error$This object cannot be container. $Unknown message $all$continue$dacl$group$minpath$minpath=%u$name$none$owner$p$p$primarygroup$s-1-1-0$s-1-5-32-545$sacl$sddl$sdsize$stop$these editing options are not implemented for this object$type=0x$type=0x%x flags=0x%x accessmask=0x%x
API String ID: 383658361-1079679044
Opcode ID: 24ae20e487b3fbbcb4606f76596315f1a48ec673b918b545e60ca03d21bd24e4
Instruction ID: 31829953638af191d9a96db3e56a10bd7131e771bc8bad9d10d656abd3f688e9
Opcode Fuzzy Hash: 24ae20e487b3fbbcb4606f76596315f1a48ec673b918b545e60ca03d21bd24e4
Instruction Fuzzy Hash: 4C63A474A00215DFDB25EB64CC84BDEB7BDBFA9300F0041D9E986A7285DB749A85CF60

Function 0102E7AC Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0102E7B1
#540.MFC42U(00000002,?,?), ref: 0102E809
#2755.MFC42U(0000005C,00000002,?,?), ref: 0102E817
#858.MFC42U(?,0000005C,00000002,?,?), ref: 0102E82C
#2910.MFC42U(00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E851
#2910.MFC42U(00000000,00000000,00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E85E
LookupAccountNameW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000032,00000000), ref: 0102E864
#861.MFC42U(00000000,?,?), ref: 0102E877
#942.MFC42U(01001514,00000000,?,?), ref: 0102E883
#940.MFC42U(?,01001514,00000000,?,?), ref: 0102E891
#4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E898
#4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E89F
#800.MFC42U(?,?), ref: 0102E8B1
#2910.MFC42U(00000000,?,00000032,00000000,00000400,?,0000005C,00000002,?,?), ref: 0102E8F1
#2910.MFC42U(00000000,00000000,00000000,?,00000032,00000000,00000400,?,0000005C,00000002,?,?), ref: 0102E8FE
LookupAccountNameW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000032,00000000), ref: 0102E904
#858.MFC42U(?,?,?), ref: 0102E911

Strings

2, xrefs: 0102E7F2

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910$#4197#858AccountLookupName$#2755#540#800#861#940#942H_prolog
String ID: 2
API String ID: 2393241501-450215437
Opcode ID: 7dd40080386fb234284cb194f071b6abecaa21ed9a18f4b8e9689aec1b73025a
Instruction ID: 2e9b923ec4b290bea4cd1781c9e0833a9b4e8cd3dbab4b455301ef9d011e607f
Opcode Fuzzy Hash: 7dd40080386fb234284cb194f071b6abecaa21ed9a18f4b8e9689aec1b73025a
Instruction Fuzzy Hash: 1A313071A001299ADB15EB54CC80AEEB3FDBF94300F4085AAE195E2180DF759B868FE1

Function 0101CA79 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?), ref: 0101CA9B
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0101CACC
PrivilegeCheck.ADVAPI32(?,?,?), ref: 0101CAEF
GetLastError.KERNEL32(Failed to adjust token privilege :), ref: 0101CB15
_CxxThrowException.MSVCRT(?,010414A0), ref: 0101CB2D

Strings

PrivilegeCheck, xrefs: 0101CAFC
Failed to adjust token privilege :, xrefs: 0101CB10

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: Privilege$AdjustCheckErrorExceptionLastLookupPrivilegesThrowTokenValue
String ID: Failed to adjust token privilege :$PrivilegeCheck
API String ID: 2631020509-280027001
Opcode ID: dc074001dd398aab2b9ce1a3b71a40f9be93eec4fbb6dbcf36289e0394ac99a3
Instruction ID: 53878ad32b9bb8206db5103152bc2b34d827553a8a3b4bdc9883495f992abd34
Opcode Fuzzy Hash: dc074001dd398aab2b9ce1a3b71a40f9be93eec4fbb6dbcf36289e0394ac99a3
Instruction Fuzzy Hash: 39213672E40218ABEB11DFD5DD84AEEBBBCBB45741F00001AB581EB148D7B4A905CBA0

Function 01036161 Relevance: 289.9, APIs: 114, Strings: 51, Instructions: 1125COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01036166
#538.MFC42U(010014DC,00000000,?,00000002), ref: 0103617A
#4197.MFC42U(010014DC,00000000,?,00000002), ref: 0103618C
#538.MFC42U(010014DC,010014DC,00000000,?,00000002), ref: 01036195
#540.MFC42U(010014DC,010014DC,00000000,?,00000002), ref: 010361A1
#540.MFC42U(010014DC,010014DC,00000000,?,00000002), ref: 010361AD
#2910.MFC42U(00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010361CC

Part of subcall function 010358C5: wcslen.MSVCRT ref: 010358C9

#2910.MFC42U(00000000,+subdirectories,00000004,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010361E9

Part of subcall function 010358C5: wcsncmp.MSVCRT ref: 010358E3

#2910.MFC42U(00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 0103624E
#2910.MFC42U(00000000,+service,00000004,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004), ref: 0103626B
#2910.MFC42U(00000000,+driver,00000004,00000000,00000000,+service,00000004,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F), ref: 01036288
#2910.MFC42U(00000000,/driver,00000004,00000000,00000000,+driver,00000004,00000000,00000000,+service,00000004,00000000,00000000,/service,00000004,?), ref: 010362A5
#2910.MFC42U(00000000,/file,00000004,00000000,00000000,/driver,00000004,00000000,00000000,+driver,00000004,00000000,00000000,+service,00000004,00000000), ref: 010362C2
#2910.MFC42U(00000000,+file,00000004,00000000,00000000,/file,00000004,00000000,00000000,/driver,00000004,00000000,00000000,+driver,00000004,00000000), ref: 010362DF
#2910.MFC42U(00000000,/onlyfile,00000004,?,+file=,00000004,?,0000001F,0000003D,?,/file=,00000004,?,0000001F,0000003D,00000000), ref: 01036344
#2910.MFC42U(00000000,+onlyfile,00000004,00000000,00000000,/onlyfile,00000004,?,+file=,00000004,?,0000001F,0000003D,?,/file=,00000004), ref: 01036361
#2910.MFC42U(00000000,/reparsepoint,00000004,00000000,00000000,+onlyfile,00000004,00000000,00000000,/onlyfile,00000004,?,+file=,00000004,?,0000001F), ref: 0103637E
#2910.MFC42U(00000000,+reparsepoint,00000004,00000000,00000000,/reparsepoint,00000004,00000000,00000000,+onlyfile,00000004,00000000,00000000,/onlyfile,00000004,?), ref: 0103639B
#2910.MFC42U(00000000,/keyreg,00000004,00000000,00000000,+reparsepoint,00000004,00000000,00000000,/reparsepoint,00000004,00000000,00000000,+onlyfile,00000004,00000000), ref: 010363B8
#2910.MFC42U(00000000,+keyreg,00000004,00000000,00000000,/keyreg,00000004,00000000,00000000,+reparsepoint,00000004,00000000,00000000,/reparsepoint,00000004,00000000), ref: 010363D5
#2910.MFC42U(00000000,/kernelobject,00000004,00000000,00000000,+keyreg,00000004,00000000,00000000,/keyreg,00000004,00000000,00000000,+reparsepoint,00000004,00000000), ref: 010363F2
#2910.MFC42U(00000000,+kernelobject,00000004,00000000,00000000,/kernelobject,00000004,00000000,00000000,+keyreg,00000004,00000000,00000000,/keyreg,00000004,00000000), ref: 0103640F
#2910.MFC42U(00000000,/subkeyreg,00000005,00000000,00000000,+kernelobject,00000004,00000000,00000000,/kernelobject,00000004,00000000,00000000,+keyreg,00000004,00000000), ref: 0103642C
#2910.MFC42U(00000000,+subkeyreg,00000005,00000000,00000000,/subkeyreg,00000005,00000000,00000000,+kernelobject,00000004,00000000,00000000,/kernelobject,00000004,00000000), ref: 01036449
#2910.MFC42U(00000000,/regkey,00000004,00000000,00000000,+subkeyreg,00000005,00000000,00000000,/subkeyreg,00000005,00000000,00000000,+kernelobject,00000004,00000000), ref: 01036466
#2910.MFC42U(00000000,+regkey,00000004,00000000,00000000,/regkey,00000004,00000000,00000000,+subkeyreg,00000005,00000000,00000000,/subkeyreg,00000005,00000000), ref: 01036483
#2910.MFC42U(00000000,/share,00000004,00000000,00000000,+regkey,00000004,00000000,00000000,/regkey,00000004,00000000,00000000,+subkeyreg,00000005,00000000), ref: 010364A0
#2910.MFC42U(00000000,+share,00000004,00000000,00000000,/share,00000004,00000000,00000000,+regkey,00000004,00000000,00000000,/regkey,00000004,00000000), ref: 010364BD
#2910.MFC42U(00000000,/printer,00000004,00000000,00000000,+share,00000004,00000000,00000000,/share,00000004,00000000,00000000,+regkey,00000004,00000000), ref: 010364DA
#2910.MFC42U(00000000,+printer,00000004,00000000,00000000,/printer,00000004,00000000,00000000,+share,00000004,00000000,00000000,/share,00000004,00000000), ref: 010364F7
#2910.MFC42U(00000000,/process,00000004,00000000,00000000,+printer,00000004,00000000,00000000,/printer,00000004,00000000,00000000,+share,00000004,00000000), ref: 01036514
#2910.MFC42U(00000000,+process,00000004,00000000,00000000,/process,00000004,00000000,00000000,+printer,00000004,00000000,00000000,/printer,00000004,00000000), ref: 01036531
#2910.MFC42U(00000000,/metabase,00000004,00000000,00000000,+process,00000004,00000000,00000000,/process,00000004,00000000,00000000,+printer,00000004,00000000), ref: 0103654E
#2910.MFC42U(00000000,+metabase,00000004,00000000,00000000,/metabase,00000004,00000000,00000000,+process,00000004,00000000,00000000,/process,00000004,00000000), ref: 0103656B
#2910.MFC42U(00000000,/samobject,00000004,00000000,00000000,+metabase,00000004,00000000,00000000,/metabase,00000004,00000000,00000000,+process,00000004,00000000), ref: 01036588
#2910.MFC42U(00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000,00000000,+metabase,00000004,00000000,00000000,/metabase,00000004,00000000), ref: 010365A5
#2910.MFC42U(00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000,00000000,+metabase,00000004,00000000), ref: 010365C2
#2910.MFC42U(00000000,+clustershare,00000004,00000000,00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000), ref: 010365DB
#2910.MFC42U(00000000,/playfile,00000004,00000000,00000000,+clustershare,00000004,00000000,00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000), ref: 010365F4
#4197.MFC42U(?,/file=,00000004,?,0000001F,0000003D,00000000,00000000,+file,00000004,00000000,00000000,/file,00000004,00000000,00000000), ref: 010366BD
#2910.MFC42U(00000000,filesonly,00000001,?,/file=,00000004,?,0000001F,0000003D,00000000,00000000,+file,00000004,00000000,00000000,/file), ref: 010366CF
#2910.MFC42U(00000000,directoriesonly,00000001,00000000,00000000,filesonly,00000001,?,/file=,00000004,?,0000001F,0000003D,00000000,00000000,+file), ref: 010366FA
#2910.MFC42U(00000000,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004,?,0000001F), ref: 0103673E
#2910.MFC42U(00000000,00000000,00000000,00000000,/service,00000004,?,+subdirectories=,00000004,?,0000001F,0000003D,?,/subdirectories=,00000004,?), ref: 0103674D
#4197.MFC42U(?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000,/subdirectories,00000004,010014DC,010014DC), ref: 0103676B
#2910.MFC42U(00000000,filesonly,00000001,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000,/subdirectories), ref: 0103677D
#2910.MFC42U(00000000,directoriesonly,00000001,00000000,00000000,filesonly,00000001,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories), ref: 0103679F
#4273.MFC42U(00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010367C7
#800.MFC42U(00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 010367DD
#2910.MFC42U(00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 01036816
#2910.MFC42U(00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?), ref: 01036844
#858.MFC42U(0000001F,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000), ref: 0103686D
#861.MFC42U(010014DC,0000001F,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC), ref: 0103687A
wcscmp.MSVCRT ref: 01036895
#4124.MFC42U(?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC), ref: 010368B2
#2910.MFC42U(00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC), ref: 010368BE
#861.MFC42U(-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010368CA
#800.MFC42U(-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010368D6
#4272.MFC42U(?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000,00000000), ref: 010368E4
#858.MFC42U(00000000,?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000), ref: 010368F1
#800.MFC42U(00000000,?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002,00000000), ref: 010368FD
#858.MFC42U(?,00000000,?,00000003,-00000004,00000000,?,00000002,00000000,00000000,00000000,00000000,01003608,00000002,00000000,00000002), ref: 0103693A

Part of subcall function 010359B7: #4124.MFC42U(?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000), ref: 010359E9
Part of subcall function 010359B7: #858.MFC42U(00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 010359F6
Part of subcall function 010359B7: #800.MFC42U(00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 01035A02
Part of subcall function 010359B7: #4272.MFC42U(00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F), ref: 01035A10
Part of subcall function 010359B7: #858.MFC42U(00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?), ref: 01035A1F
Part of subcall function 010359B7: #800.MFC42U(00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?), ref: 01035A2B
Part of subcall function 010359B7: #2910.MFC42U(00000000,00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004), ref: 01035A35
Part of subcall function 010359B7: wcslen.MSVCRT ref: 01035A3B

#858.MFC42U(0000001F,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?,00000002), ref: 01036971
#2910.MFC42U(00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC,010014DC,00000000,?), ref: 01036986
#858.MFC42U(00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004,010014DC), ref: 0103699C
#858.MFC42U(00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010369A5
#800.MFC42U(00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 010369B1
#2910.MFC42U(00000000), ref: 01036A1A
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000), ref: 01036A26
GetLastError.KERNEL32(OpenSCManager :), ref: 01036A37
#2910.MFC42U(00000000), ref: 01036A62
#823.MFC42U(000001FC), ref: 01036AA6
#2910.MFC42U(00000000,00000000,?), ref: 01036AC3

Part of subcall function 010359B7: __EH_prolog.LIBCMT ref: 010359BC
Part of subcall function 010359B7: #2755.MFC42U(?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000), ref: 010359CA

wcscmp.MSVCRT ref: 01036AEC
#2910.MFC42U(00000000), ref: 01036AFC
#2910.MFC42U(00000000), ref: 01036B39
#2910.MFC42U(00000000), ref: 01036B58
#823.MFC42U(0000044C,00000000), ref: 01036BA5
#2910.MFC42U(00000000,00000000), ref: 01036BBA
#823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036BE2
#2910.MFC42U(00000000,00000000,00000001,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000), ref: 01036BFC
#823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C19
#823.MFC42U(00001340,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C3C
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C50
#823.MFC42U(000001F8,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C78
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036C8C
#823.MFC42U(00000220,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036CB4
#2910.MFC42U(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000), ref: 01036CCA
#823.MFC42U(000001F8,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036CF2
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D06

Part of subcall function 010359B7: #538.MFC42U(?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000,/subdirectories), ref: 01035A53
Part of subcall function 010359B7: #535.MFC42U(?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000,00000000), ref: 01035A65
Part of subcall function 010359B7: wcsncmp.MSVCRT ref: 01035A71
Part of subcall function 010359B7: #800.MFC42U(00000000,?,00000002), ref: 01035A87
Part of subcall function 010359B7: #800.MFC42U(00000000,?,00000002), ref: 01035A93

#823.MFC42U(000001F0,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D40
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D54
#823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D7C
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036D90
#823.MFC42U(000001FC,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036DB9
#540.MFC42U(00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories,00000004), ref: 01036DD6
#2910.MFC42U(00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000,/subdirectories), ref: 01036DEC
#538.MFC42U(00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000), ref: 01036DF5
#540.MFC42U(00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000,01003608,00000002,00000000,00000002,00000000,00000000), ref: 01036E01
GetLastError.KERNEL32(Parsing registry key error :,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?), ref: 01036E31
#2910.MFC42U(00000000), ref: 01036E5C
#800.MFC42U ref: 01036EA6
#800.MFC42U ref: 01036EB2
#800.MFC42U ref: 01036EBE
#823.MFC42U(00000200,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?), ref: 01036ECD
#2910.MFC42U(00000000,00000000,00000000,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 01036EE4
#2910.MFC42U(00000000,00000000,00000000,00000000,00000000,?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 01036EEE
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F14
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F20
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F2C
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F38
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F44
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F4F
#800.MFC42U(?,?,0000001F,00000001,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000002,?,00000000), ref: 01036F5B

Strings

+subdirectories=, xrefs: 01036231
/playfile, xrefs: 010365EC
/subdirectories, xrefs: 010361B7
+regkey, xrefs: 0103647B
will not be processed. Dfs path is not supported, xrefs: 01036A08
Remote access is not allowed for kernelobject or process, xrefs: 0103694C
/metabase, xrefs: 01036546
+share, xrefs: 010364B5
Unknown message , xrefs: 01036A80, 01036A87, 01036B76, 01036B7D, 01036E7A, 01036E81
- DfsPath is not supported, xrefs: 01036833
+file, xrefs: 010362D7
/file, xrefs: 010362BA
/keyreg, xrefs: 010363B0
OpenSCManager :, xrefs: 01036A32
+subkeyreg, xrefs: 01036441
/share, xrefs: 01036498
/driver, xrefs: 0103629D
Parsing registry key error :, xrefs: 01036E2C
+service, xrefs: 01036263
is invalid. You should use filesonly or directoriesonly , xrefs: 01036726
Could not open Sam Server :, xrefs: 01036B0F
/samobject, xrefs: 01036580
+printer, xrefs: 010364EF
/reparsepoint, xrefs: 01036376
--- DEBUG ObjCreateInstance - Error FileFullPathName = , xrefs: 010369CB
+onlyfile, xrefs: 01036359
/subkeyreg, xrefs: 01036424
+driver, xrefs: 01036280
/file=, xrefs: 01036303
+process, xrefs: 01036529
/service, xrefs: 01036246
filesonly, xrefs: 010366C6, 01036774
+samobject, xrefs: 0103659D
+subdirectories, xrefs: 010361E1
/process, xrefs: 0103650C
+keyreg, xrefs: 010363CD
+kernelobject, xrefs: 01036407
Error , xrefs: 01036A4E, 01036B25, 01036E48
--- DEBUG ObjCreateInstance - Default Sam Server will be = , xrefs: 01036912
/onlyfile, xrefs: 0103633C
- , xrefs: 01036B46
+file=, xrefs: 01036327
+reparsepoint, xrefs: 01036393
+metabase, xrefs: 01036563
/clustershare, xrefs: 010365BA
+clustershare, xrefs: 010365D3
/regkey, xrefs: 0103645E
directoriesonly, xrefs: 010366F1, 01036796
/subdirectories=, xrefs: 0103620D
/printer, xrefs: 010364D2
/kernelobject, xrefs: 010363EA

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910$#800$#823$#858$#538#540$#4197$#4124#4272#861ErrorH_prologLastwcscmpwcslenwcsncmp$#2755#4273#535ManagerOpen
String ID: - $ - DfsPath is not supported$ is invalid. You should use filesonly or directoriesonly $ will not be processed. Dfs path is not supported$+clustershare$+driver$+file$+file=$+kernelobject$+keyreg$+metabase$+onlyfile$+printer$+process$+regkey$+reparsepoint$+samobject$+service$+share$+subdirectories$+subdirectories=$+subkeyreg$--- DEBUG ObjCreateInstance - Default Sam Server will be = $--- DEBUG ObjCreateInstance - Error FileFullPathName = $/clustershare$/driver$/file$/file=$/kernelobject$/keyreg$/metabase$/onlyfile$/playfile$/printer$/process$/regkey$/reparsepoint$/samobject$/service$/share$/subdirectories$/subdirectories=$/subkeyreg$Could not open Sam Server :$Error $OpenSCManager :$Parsing registry key error :$Remote access is not allowed for kernelobject or process$Unknown message $directoriesonly$filesonly
API String ID: 4197239884-3296023821
Opcode ID: f0bff6946ef0643fc75edc2c9055052a5970c531ad02b3f03adce31fb385bf0f
Instruction ID: 3690535e73fda2d2dba8554175998f4b662ee8306b69ff9f6bc4b35ffdbe1ee6
Opcode Fuzzy Hash: f0bff6946ef0643fc75edc2c9055052a5970c531ad02b3f03adce31fb385bf0f
Instruction Fuzzy Hash: 2F82C274600206BBDF15BBB9CC94BEFBBADAFA4704F400559F582E7281DB798A408761

Function 0103BC86 Relevance: 214.4, APIs: 106, Strings: 16, Instructions: 897
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0103BC8B

Part of subcall function 01038174: __EH_prolog.LIBCMT ref: 01038179
Part of subcall function 01038174: #823.MFC42U(?,?,00000002,00000000,?,0103BCD4,00000000,00000000,01001510,00000003), ref: 010381B5

#540.MFC42U(00000000,00000000,01001510,00000003), ref: 0103BCDD
#540.MFC42U(00000000,00000000,01001510,00000003), ref: 0103BCEB
#540.MFC42U(00000000,00000000,01001510,00000003), ref: 0103BD22
#823.MFC42U(00002710,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BD5F
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00001388,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BD7C
wcscpy.MSVCRT ref: 0103BD93
#825.MFC42U(?), ref: 0103BDCF
#861.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BDE2
#4197.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BDED
#6278.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BDF8
#6279.MFC42U(?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BE03
#537.MFC42U(0101B430,?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BE2A
#800.MFC42U(?,?,0101B430,?,00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103BE4E

Part of subcall function 0103D0FB: CreateFileW.KERNELBASE(CONOUT$,C0000000,00000003,00000000,00000003,00000080,00000000,?,00000002,00000000), ref: 0103D132
Part of subcall function 0103D0FB: GetLastError.KERNEL32 ref: 0103D13B
Part of subcall function 0103D0FB: GetLargestConsoleWindowSize.KERNELBASE(?), ref: 0103D14D
Part of subcall function 0103D0FB: GetConsoleScreenBufferInfo.KERNELBASE(?,?), ref: 0103D15D
Part of subcall function 0103D0FB: CreateConsoleScreenBuffer.KERNELBASE(C0000000,00000003,00000000,00000001,00000000), ref: 0103D16A
Part of subcall function 0103D0FB: SetConsoleScreenBufferSize.KERNELBASE(00000000,?), ref: 0103D17B
Part of subcall function 0103D0FB: CloseHandle.KERNEL32(?), ref: 0103D193
Part of subcall function 0103D0FB: CloseHandle.KERNEL32(?), ref: 0103D19B
Part of subcall function 0103D0FB: #825.MFC42U(?), ref: 0103D1CA
Part of subcall function 0103D0FB: #823.MFC42U(?), ref: 0103D1D7
Part of subcall function 0103D0FB: swprintf.MSVCRT(?,Done: %8d, Modified %8d, Failed %8d, Syntax errors %8d,?,?,?,0104E3E8), ref: 0103D21C

Part of subcall function 0103CF1C: SetConsoleActiveScreenBuffer.KERNEL32(?,00000000,0103BC4B,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000,01001510), ref: 0103CF32

wcscmp.MSVCRT ref: 0103BEA2
#861.MFC42U ref: 0103BEC0
#540.MFC42U ref: 0103BEF3
#535.MFC42U(?), ref: 0103BF09
#538.MFC42U(WARNING : ,?), ref: 0103BF1F
#922.MFC42U(?,00000000,00000000,WARNING : ,?), ref: 0103BF31
#925.MFC42U(?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF47
#858.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF57
#800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF66
#800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF75
#800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF84
#800.MFC42U(00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BF93
#2910.MFC42U(00000000,00000000,?,00000000, : No previous object opened,?,00000000,00000000,WARNING : ,?), ref: 0103BFA6
#800.MFC42U(?), ref: 0103BFD8
#540.MFC42U(?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C07C
#538.MFC42U( : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C090
#535.MFC42U(?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C0A8
#538.MFC42U(WARNING : ,?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C0C2
#922.MFC42U(?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C0D9
#922.MFC42U(?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?,00000000,00000000,00000000,?), ref: 0103C0EB
#922.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?,00000000), ref: 0103C106
#858.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C116
#800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C125
#800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C134
#800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C143
#800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C152
#800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C161
#800.MFC42U(00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000,?), ref: 0103C170
#800.MFC42U(?), ref: 0103C1CA
#800.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C380
#800.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C38F
#2910.MFC42U(00000000,00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?), ref: 0103C3A2
#800.MFC42U ref: 0103C417
#800.MFC42U ref: 0103C426
#2756.MFC42U(010025F4), ref: 0103C69A
wcscmp.MSVCRT ref: 0103C6B0
#538.MFC42U(WARNING : Error parsing line ), ref: 0103C6DF
#922.MFC42U(?,00000000,?,WARNING : Error parsing line ), ref: 0103C6F7
#800.MFC42U(?,00000000,?,WARNING : Error parsing line ), ref: 0103C706
#2910.MFC42U(00000000,?,00000000,?,WARNING : Error parsing line ), ref: 0103C719
#4124.MFC42U(?,000000FF), ref: 0103C77E
#858.MFC42U(00000000,?,000000FF), ref: 0103C78E
#800.MFC42U(00000000,?,000000FF), ref: 0103C79D
#6279.MFC42U(00000000,?,000000FF), ref: 0103C7A8
#538.MFC42U(?,00000000,?,000000FF), ref: 0103C7BA
#4272.MFC42U(?,000000FF,?,00000000,?,000000FF), ref: 0103C7D6
#858.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C7E6
#800.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C7F5
#6278.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C800
#5597.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C811
#5597.MFC42U(00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C81C
#538.MFC42U(WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C85F
#922.MFC42U(000000FF,00000000,?,WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C877
#800.MFC42U(000000FF,00000000,?,WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C886
#2910.MFC42U(00000000,000000FF,00000000,?,WARNING : Error parsing line ,?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C899
#2910.MFC42U(00000000,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Invalid option : ,?,00000000), ref: 0103C183

Part of subcall function 0103D271: __EH_prolog.LIBCMT ref: 0103D276
Part of subcall function 0103D271: #538.MFC42U(Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D288
Part of subcall function 0103D271: #922.MFC42U(?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D299
Part of subcall function 0103D271: #858.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2A6
Part of subcall function 0103D271: #800.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2B2
Part of subcall function 0103D271: #800.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2BE

#535.MFC42U(?,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C060

Part of subcall function 01035405: __EH_prolog.LIBCMT ref: 0103540A
Part of subcall function 01035405: #535.MFC42U(?,00000000), ref: 01035458
Part of subcall function 01035405: #4197.MFC42U(?,00000000), ref: 01035463
Part of subcall function 01035405: #535.MFC42U(?,01001510,?,?,00000000), ref: 0103548E
Part of subcall function 01035405: #535.MFC42U(?,?,01001510,?,?,00000000), ref: 0103549E
Part of subcall function 01035405: #538.MFC42U(010014DC,?,?,01001510,?,?,00000000), ref: 010354AF
Part of subcall function 01035405: #2910.MFC42U(00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355C4
Part of subcall function 01035405: #2756.MFC42U(00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355CD
Part of subcall function 01035405: #922.MFC42U(?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000), ref: 010355E9
Part of subcall function 01035405: #858.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 010355F6
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035602
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103560E
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103561A
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035625
Part of subcall function 01035405: #800.MFC42U(?,00000000), ref: 01035648

#538.MFC42U( : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C1E5
#535.MFC42U(?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C1FD
#538.MFC42U(WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C217
#922.MFC42U(?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C22E
#922.MFC42U(?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?,?,?,00000000), ref: 0103C240
#922.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C25B
#800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C26A
#800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C279
#800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C288
#800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C297
#800.MFC42U(?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000,00000000,00000000,?), ref: 0103C2A6
#800.MFC42U(?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ,00000000), ref: 0103C2D3
#535.MFC42U(?,?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ,?, : Error when checking arguments - ), ref: 0103C2F4
#540.MFC42U(?,00000000,?,?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?,WARNING : ), ref: 0103C310
#538.MFC42U(Current object ,?,00000000,?,?,?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,?), ref: 0103C324
#922.MFC42U(?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000,?,?,00000000,00000000), ref: 0103C33C
#925.MFC42U(?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000,?), ref: 0103C352
#858.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C362
#800.MFC42U(00000000,?,00000000, will not be processed,?,00000000,?,Current object ,?,00000000,?,?,?,00000000,?,00000000), ref: 0103C371
#800.MFC42U(?), ref: 0103C8EA
#800.MFC42U(?,?,?,?,00000000,?,000000FF,?,00000000,?,000000FF), ref: 0103C913
#2910.MFC42U(00000000,?,?,?,00000000), ref: 0103C02D

Part of subcall function 010383F6: __EH_prolog.LIBCMT ref: 010383FB
Part of subcall function 010383F6: #540.MFC42U(01001510,00000002,00000000), ref: 01038447
Part of subcall function 010383F6: #538.MFC42U(?,01001510,00000002,00000000), ref: 0103845D
Part of subcall function 010383F6: #540.MFC42U(?,01001510,00000002,00000000), ref: 0103846C
Part of subcall function 010383F6: #540.MFC42U(?,01001510,00000002,00000000), ref: 0103847B
Part of subcall function 010383F6: #538.MFC42U(none,?,01001510,00000002,00000000), ref: 0103848F
Part of subcall function 010383F6: #2910.MFC42U(00000000), ref: 010384D7
Part of subcall function 010383F6: #861.MFC42U(?,none,?,01001510,00000002,00000000), ref: 01038503
Part of subcall function 010383F6: #4197.MFC42U(?,none,?,01001510,00000002,00000000), ref: 0103850E
Part of subcall function 010383F6: #2755.MFC42U(0000003D,?,none,?,01001510,00000002,00000000), ref: 01038522
Part of subcall function 010383F6: #2910.MFC42U(00000000,/display,00000004,0000003D,?,none,?,01001510,00000002,00000000), ref: 01038540
Part of subcall function 010383F6: #800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 01038570
Part of subcall function 010383F6: #800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103857F
Part of subcall function 010383F6: #800.MFC42U(-00000012,00000000,00000000,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000,0000003D,?,none), ref: 0103858E

__RTDynamicCast.MSVCRT ref: 0103C9FC
#2755.MFC42U(0000002A), ref: 0103CA29

Part of subcall function 01031DDF: __EH_prolog.LIBCMT ref: 01031DE4

#800.MFC42U(00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103CAB8
#800.MFC42U(00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103CAC6
#800.MFC42U(00000002,?,00000000,?,?,?,00000000,00000000,01001510,00000003), ref: 0103CAD5

Strings

+, xrefs: 0103C446
: Error when checking arguments - , xrefs: 0103C1DA
/apply, xrefs: 0103BE97
--- DEBUG L"Parsing Adding *.*" = , xrefs: 0103C5B0
: Invalid option : , xrefs: 0103C081
WARNING : Error parsing line , xrefs: 0103C6D4, 0103C854
will not be processed, xrefs: 0103C341
WARNING : , xrefs: 0103BF10, 0103C0B3, 0103C208
/display, xrefs: 0103C4D1, 0103C984
*.*, xrefs: 0103C569
--- DEBUG Playfile - ExpandEnvironmentVariable - Buffer = , xrefs: 0103BDAB
Current object , xrefs: 0103C315
Use :, xrefs: 0103C1B8, 0103C74E, 0103C8CE
: No previous object opened, xrefs: 0103BF36
</subinacl>, xrefs: 0103C3BF, 0103C3D3, 0103CA8E, 0103CAA2
+, xrefs: 0103C9F8

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#538$#922$#2910#540$#535$#858$H_prolog$Console$BufferScreen$#4197#823#861$#2755#2756#5597#6278#6279#825#925CloseCreateHandleSizewcscmp$#4124#4272#537ActiveCastDynamicEnvironmentErrorExpandFileInfoLargestLastStringsWindowswprintfwcscpy
String ID: : Error when checking arguments - $ : Invalid option : $ : No previous object opened$ will not be processed$*.*$+$+$--- DEBUG L"Parsing Adding *.*" = $--- DEBUG Playfile - ExpandEnvironmentVariable - Buffer = $/apply$/display$</subinacl>$Current object $Use :$WARNING : $WARNING : Error parsing line
API String ID: 4124773709-89342281
Opcode ID: 40cbe0dc6e3397d7ec43c22822d7be1750bdcd2234503bd660db9f684c798d17
Instruction ID: 80da87f453f359b6bc8bca84971c688de2c5dc13d5e4e764c5231f5cf22e16a1
Opcode Fuzzy Hash: 40cbe0dc6e3397d7ec43c22822d7be1750bdcd2234503bd660db9f684c798d17
Instruction Fuzzy Hash: 95923C70808259DFDF25EBA4C998ADDB7B8EF69300F0041DAE18DA3191DB745B88DF61

Function 01033E45 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 01033E4A
SetConsoleCtrlHandler.KERNEL32(01032603,00000001), ref: 01033E5E
CoInitialize.OLE32(00000000), ref: 01033E67
GetCommandLineW.KERNEL32(?), ref: 01033E71
CommandLineToArgvW.SHELL32(00000000), ref: 01033E78
#823.MFC42U(000000A4), ref: 01033E92

Strings

Can't open playfile file , xrefs: 01034058
/playfile, xrefs: 01034005
/help, xrefs: 01033EFB
--- DEBUG Option = , xrefs: 01034113

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: CommandLine$#823ArgvConsoleCtrlH_prologHandlerInitialize
String ID: --- DEBUG Option = $/help$/playfile$Can't open playfile file
API String ID: 780783075-2399648983
Opcode ID: 9d8fb24dd25c3e7f5de69b308beb37e1556edb647800677095af126dd49a5cf6
Instruction ID: 9163a72d6d4645e1231c6f6c94704be91423c6ec0ea9a91bcba559d490b20847
Opcode Fuzzy Hash: 9d8fb24dd25c3e7f5de69b308beb37e1556edb647800677095af126dd49a5cf6
Instruction Fuzzy Hash: DFC1C674600206EFDB25EFA4C9C5BEEBBB8FF94340F404169E582EB190DB749941CBA1

Function 0103D0FB Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(CONOUT$,C0000000,00000003,00000000,00000003,00000080,00000000,?,00000002,00000000), ref: 0103D132
GetLastError.KERNEL32 ref: 0103D13B
GetLargestConsoleWindowSize.KERNELBASE(?), ref: 0103D14D
GetConsoleScreenBufferInfo.KERNELBASE(?,?), ref: 0103D15D
CreateConsoleScreenBuffer.KERNELBASE(C0000000,00000003,00000000,00000001,00000000), ref: 0103D16A
SetConsoleScreenBufferSize.KERNELBASE(00000000,?), ref: 0103D17B
CloseHandle.KERNEL32(?), ref: 0103D193
CloseHandle.KERNEL32(?), ref: 0103D19B
#825.MFC42U(?), ref: 0103D1CA
#823.MFC42U(?), ref: 0103D1D7
swprintf.MSVCRT(?,Done: %8d, Modified %8d, Failed %8d, Syntax errors %8d,?,?,?,0104E3E8), ref: 0103D21C
wcslen.MSVCRT ref: 0103D22E
wcslen.MSVCRT ref: 0103D248

Strings

Done: %8d, Modified %8d, Failed %8d, Syntax errors %8d, xrefs: 0103D216
CONOUT$, xrefs: 0103D125

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: Console$BufferScreen$CloseCreateHandleSizewcslen$#823#825ErrorFileInfoLargestLastWindowswprintf
String ID: CONOUT$$Done: %8d, Modified %8d, Failed %8d, Syntax errors %8d
API String ID: 1408109423-1750436640
Opcode ID: 66b9f1fb9c3885247eb86ec3bc86fc92f9845a976e8ed8b25a90ce8fde2083c3
Instruction ID: bffc80b2db10923d8a8cbad10d696d40b3616232fffa861adff8575fa400b5fc
Opcode Fuzzy Hash: 66b9f1fb9c3885247eb86ec3bc86fc92f9845a976e8ed8b25a90ce8fde2083c3
Instruction Fuzzy Hash: 9341AC71500704AFD7359FA5DC84AAABBF9EF88714F100A2DE59AD7680DB35E901CF40

Function 0103CDA7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
timefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0103CC63: SetConsoleActiveScreenBuffer.KERNELBASE(?,0103BA91,00000001,00000001), ref: 0103CC6B

GetSystemTime.KERNEL32(?,00000000,01001510,00000003), ref: 0103CDCF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0103CDF1
SystemTimeToFileTime.KERNEL32(0104E41C,?), ref: 0103CDFB
FileTimeToSystemTime.KERNEL32(?,?), ref: 0103CE17
sprintf.MSVCRT ref: 0103CE46
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 0103CE6B
#942.MFC42U(01001510), ref: 0103CE9B
#823.MFC42U(?,01001510), ref: 0103CEA7
#2910.MFC42U(00000000,01001510), ref: 0103CEB7
sprintf.MSVCRT ref: 0103CEC5
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 0103CEE9
#825.MFC42U(?), ref: 0103CEF2

Strings

Elapsed Time: %2.2d %2.2d:%2.2d:%2.2dDone: %8d, Modified %8d, Failed %8d, Syntax errors %8d, xrefs: 0103CE40

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: Time$File$System$Writesprintf$#2910#823#825#942ActiveBufferConsoleScreen
String ID: Elapsed Time: %2.2d %2.2d:%2.2d:%2.2dDone: %8d, Modified %8d, Failed %8d, Syntax errors %8d
API String ID: 3434378175-1280237250
Opcode ID: bae32ccf172500730bb93b2fa814b37c33420357147743ac0ec1d7874639b423
Instruction ID: 59f7b6d4848c89bef59f4bbc9684ed178adc93bf01e891d5396cbb49e3e7bcb6
Opcode Fuzzy Hash: bae32ccf172500730bb93b2fa814b37c33420357147743ac0ec1d7874639b423
Instruction Fuzzy Hash: 3D51E5B2900208DFCB25DFE9D9888EEBBFDFF48300B14452AE586E7250DB35A945CB50

Function 0103004F Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 01030054
#535.MFC42U(0000003E,00000001,00000002,00000001), ref: 0103007D
#4197.MFC42U(0000003E,00000001,00000002,00000001), ref: 010300BA
SetLastError.KERNEL32(00000539,?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 0103012E

Part of subcall function 0101D5F3: wcscmp.MSVCRT ref: 0101D5FD

Part of subcall function 0102E7AC: __EH_prolog.LIBCMT ref: 0102E7B1
Part of subcall function 0102E7AC: #540.MFC42U(00000002,?,?), ref: 0102E809
Part of subcall function 0102E7AC: #2755.MFC42U(0000005C,00000002,?,?), ref: 0102E817
Part of subcall function 0102E7AC: #858.MFC42U(?,0000005C,00000002,?,?), ref: 0102E82C
Part of subcall function 0102E7AC: #2910.MFC42U(00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E851
Part of subcall function 0102E7AC: #2910.MFC42U(00000000,00000000,00000000,?,00000032,00000000,00000400,?,?,0000005C,00000002,?,?), ref: 0102E85E
Part of subcall function 0102E7AC: LookupAccountNameW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000032,00000000), ref: 0102E864
Part of subcall function 0102E7AC: #861.MFC42U(00000000,?,?), ref: 0102E877
Part of subcall function 0102E7AC: #942.MFC42U(01001514,00000000,?,?), ref: 0102E883
Part of subcall function 0102E7AC: #940.MFC42U(?,01001514,00000000,?,?), ref: 0102E891
Part of subcall function 0102E7AC: #4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E898
Part of subcall function 0102E7AC: #4197.MFC42U(?,01001514,00000000,?,?), ref: 0102E89F
Part of subcall function 0102E7AC: #800.MFC42U(?,?), ref: 0102E8B1

#800.MFC42U(?,?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 0103013D
#800.MFC42U(?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 01030151
#800.MFC42U(?,010014DC,?,?,0000003E,00000001,00000002,00000001), ref: 0103015D
#535.MFC42U(?,?,?,?,?,010014DC,00000002,?,00000002,00000002,00000001,00000002,00000001), ref: 010301D7

Part of subcall function 0102F553: __EH_prolog.LIBCMT ref: 0102F558
Part of subcall function 0102F553: #800.MFC42U(?,?,?,?,0102FE92,?,?,?,?,010014DC,?,?,?,010014DC,00000001,00000002), ref: 0102F5B9

Part of subcall function 0102EDD7: #858.MFC42U(010014A0,010014DC,?,01001510,0102FA4B,?,?,?,?,?,010014DC,?,?,010014DC,010014DC,?), ref: 0102EDED

#535.MFC42U(?,?,?,010014DC,00000002,?,00000002,00000002,00000001,00000002,00000001), ref: 01030204
#800.MFC42U(00000002,?,?,?,010014DC,00000002,?,00000002,00000002,00000001,00000002,00000001), ref: 0103021B

Strings

--- DEBUG SidFactory::LookupAccount using OffLine sam = , xrefs: 0103009C
--- DEBUG SidFactory::LookupAccount Found = , xrefs: 01030100

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#4197#535H_prolog$#2910#858$#2755#540#861#940#942AccountErrorLastLookupNamewcscmp
String ID: --- DEBUG SidFactory::LookupAccount Found = $--- DEBUG SidFactory::LookupAccount using OffLine sam =
API String ID: 1683914480-1924730002
Opcode ID: c20567f65207412d0b3d041c232d47fef1ec68655a5ef6fb4bf38793f5dc2c55
Instruction ID: 5cc80e20ccd1446014a266db7848a00264bdcc3f3a349ab5d7f9e086484581f9
Opcode Fuzzy Hash: c20567f65207412d0b3d041c232d47fef1ec68655a5ef6fb4bf38793f5dc2c55
Instruction Fuzzy Hash: B751B671A00219DFDB55EFE8C984AEEB7BDBF98300F004159F58697288DB749A05CB61

Function 01035EFD Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 01035F02
#823.MFC42U(00009C40,00000000,00000000,0105328C), ref: 01035F15
GetLastError.KERNEL32(CheckPriv : Memory Exhausted,00000000,00000000,0105328C), ref: 01035F29

Part of subcall function 0101C94A: __EH_prolog.LIBCMT ref: 0101C94F
Part of subcall function 0101C94A: #540.MFC42U(?,?,0101C9FE,00000000), ref: 0101C967

_CxxThrowException.MSVCRT(?,010414A0), ref: 01035F41

Strings

CheckPriv : Memory Exhausted, xrefs: 01035F24
SeChangeNotifyPrivilege, xrefs: 01035F7C
SeTakeOwnershipPrivilege, xrefs: 01035F75
SeBackupPrivilege, xrefs: 01035F68
SeSecurityPrivilege, xrefs: 01035F61
SeDebugPrivilege, xrefs: 01035F83
SeRestorePrivilege, xrefs: 01035F5C

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: H_prolog$#540#823ErrorExceptionLastThrow
String ID: CheckPriv : Memory Exhausted$SeBackupPrivilege$SeChangeNotifyPrivilege$SeDebugPrivilege$SeRestorePrivilege$SeSecurityPrivilege$SeTakeOwnershipPrivilege
API String ID: 3758986183-2495250674
Opcode ID: c40689b12edbd02dd537a50254c52b74390a91bac117c6ac13dc5df3a8758326
Instruction ID: ca9c1a17146a639ae21ffd4072e57c9e2555db06de542e15786b253ace6fee2e
Opcode Fuzzy Hash: c40689b12edbd02dd537a50254c52b74390a91bac117c6ac13dc5df3a8758326
Instruction Fuzzy Hash: 362190B1C4125AEFDB15DFD8D959BDEBBB8EF54318F108019E181B7244C7784A08CBA1

Function 0103E1D3 Relevance: 13.6, APIs: 9, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0103E244
__p__fmode.MSVCRT ref: 0103E259
__p__commode.MSVCRT ref: 0103E267
__setusermatherr.MSVCRT ref: 0103E294
_initterm.MSVCRT ref: 0103E2AA
__wgetmainargs.MSVCRT ref: 0103E2CD
_initterm.MSVCRT ref: 0103E2E0
exit.KERNELBASE ref: 0103E30D
_cexit.MSVCRT ref: 0103E313

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: _initterm$__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 1278620419-0
Opcode ID: 57d30460f2acb677fba1e5c27daeaf694d0b18a1bc77da5dd77bb179dc46e7de
Instruction ID: 3b7a2544816ff03d329415a31d7b07424d0d0560947e0e1c7814df8a0ab0a627
Opcode Fuzzy Hash: 57d30460f2acb677fba1e5c27daeaf694d0b18a1bc77da5dd77bb179dc46e7de
Instruction Fuzzy Hash: 85318F74801305DFCB26DF64D888BED7BB8FB49311F004269F491AB2A5EB3A9984CF11

Function 0101CB5C Relevance: 10.6, APIs: 7, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0101CB61
#538.MFC42U(010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CB7F
#823.MFC42U(0001E002,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBA3
#823.MFC42U(0001E002,0001E002,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBAC
GetStdHandle.KERNEL32(000000F5,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBCA
GetStdHandle.KERNEL32(000000F5,?,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBD8
GetConsoleScreenBufferInfo.KERNELBASE(00000000,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBDB

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #823Handle$#538BufferConsoleH_prologInfoScreen
String ID:
API String ID: 3315392054-0
Opcode ID: c9f1c13a9e614124e8163afa4dd005fa585c430a68498c2825fd6ce5d6ebffbe
Instruction ID: 690b3aa76e8d65da0aad0ca7bd8c2fc9f124f79f5938b890db24b6cb901c7c1b
Opcode Fuzzy Hash: c9f1c13a9e614124e8163afa4dd005fa585c430a68498c2825fd6ce5d6ebffbe
Instruction Fuzzy Hash: F011FB71900705DFD720AF6AD884A8AFBF8FF99710B104B2EE096D7650D774E944CB54

Function 0103CF3F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01035405: __EH_prolog.LIBCMT ref: 0103540A
Part of subcall function 01035405: #535.MFC42U(?,00000000), ref: 01035458
Part of subcall function 01035405: #4197.MFC42U(?,00000000), ref: 01035463
Part of subcall function 01035405: #535.MFC42U(?,01001510,?,?,00000000), ref: 0103548E
Part of subcall function 01035405: #535.MFC42U(?,?,01001510,?,?,00000000), ref: 0103549E
Part of subcall function 01035405: #538.MFC42U(010014DC,?,?,01001510,?,?,00000000), ref: 010354AF
Part of subcall function 01035405: #2910.MFC42U(00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355C4
Part of subcall function 01035405: #2756.MFC42U(00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355CD
Part of subcall function 01035405: #922.MFC42U(?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000), ref: 010355E9
Part of subcall function 01035405: #858.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 010355F6
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035602
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103560E
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103561A
Part of subcall function 01035405: #800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035625
Part of subcall function 01035405: #800.MFC42U(?,00000000), ref: 01035648

swprintf.MSVCRT(?,%8d,00000002,?,00000001,01001510,00000000,?,00000000,/playfile,00000004,00000000), ref: 0103CF7B
swprintf.MSVCRT(?,%8d,?), ref: 0103CFAC
swprintf.MSVCRT(?,%8d,000000FF,?,00000001), ref: 0103D021
swprintf.MSVCRT(?,%8d), ref: 0103D085

Strings

%8d, xrefs: 0103CF71, 0103CF79, 0103CFAA, 0103CFF6, 0103D01F, 0103D066, 0103D083

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$swprintf$#535$#2756#2910#4197#538#858#922H_prolog
String ID: %8d
API String ID: 4283975728-2626110627
Opcode ID: 128db9bd5d15eaac44a9a5cb671c008e557a6c5b04910238f8e008624092e989
Instruction ID: 760780b26fe0834c53726d2ea634f5ccb665801387a4f111df69a5e6622de4a1
Opcode Fuzzy Hash: 128db9bd5d15eaac44a9a5cb671c008e557a6c5b04910238f8e008624092e989
Instruction Fuzzy Hash: 50518D706007068BCB24DF58C590AAEB7F9FF88704B40496DD692DB751EB36E946CB80

Function 0101D34C Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0101D351

Part of subcall function 0101D247: fclose.MSVCRT ref: 0101D25A
Part of subcall function 0101D247: #861.MFC42U(010014DC,00000001,?,0101D36C,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134), ref: 0101D274

#825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D374
#825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D382
#800.MFC42U(00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000,01001510), ref: 0101D38F

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #825$#800#861H_prologfclose
String ID:
API String ID: 1175585050-0
Opcode ID: 4ce1ce899b83fd9f82b328f85860a2885963f02821b3994f9ea8b6c3ed0530ef
Instruction ID: 8eb7ba2a2adc6b13d1b7149111194d1a519a5436f74bfa490837f1c3314165f9
Opcode Fuzzy Hash: 4ce1ce899b83fd9f82b328f85860a2885963f02821b3994f9ea8b6c3ed0530ef
Instruction Fuzzy Hash: E9F058719117129BDB28EFB8D4047DAB3E8AB68321F008B5EE0E293580CB74D9008710

Function 0101D095 Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 0101D0CF
WriteConsoleW.KERNELBASE(?,?,?,?,00000000,?,00000002,00000000,?,0103BA6D,00000001), ref: 0101D0F1
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000002,00000000,?,0103BA6D,00000001), ref: 0101D10A

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: Write$ConsoleFilefwrite
String ID:
API String ID: 1664599989-0
Opcode ID: 7678c85be7fc28a4ea6ccb21fbc503a372f9777c9f52296834e66f07dbf2045e
Instruction ID: d270e4f5d1f94858587a6878ea217026f9e29cf4a2d7c8d7873b1405592516ce
Opcode Fuzzy Hash: 7678c85be7fc28a4ea6ccb21fbc503a372f9777c9f52296834e66f07dbf2045e
Instruction Fuzzy Hash: BD114FB2600605AFD7358FA8C8C8DAB77F9EB843407144A7EF68283544D775E988CBA0

Function 01032F84 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 01032F89
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ.MSVCP60(00000000,00000000,?,?,010340D2,00000001,00000000,00000000,/playfile,00000004,00000000), ref: 01032FB8
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z.MSVCP60(00000003,00000000,00000000,00000000,?,?,010340D2,00000001,00000000,00000000,/playfile,00000004,00000000), ref: 01032FD8

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: U?$char_traits@$??0?$basic_ios@??0?$basic_stringstream@G@2@@std@@G@std@@G@std@@@std@@H_prologV?$allocator@
String ID:
API String ID: 2840036378-0
Opcode ID: caf4031e04e0e920f24ab22eaca52caa624baf1b51c34b5e95c97f1f98900769
Instruction ID: 8eb153a70a92939a65bd9700be538a9bf6ebb4d25afd1a9d55ba73e670c4404c
Opcode Fuzzy Hash: caf4031e04e0e920f24ab22eaca52caa624baf1b51c34b5e95c97f1f98900769
Instruction Fuzzy Hash: B1015AB1A00314DFE716CF94C5487AEFBF8FB98705F00855DE192A7680CBB89A01CB90

Function 0101E01D Relevance: 4.5, APIs: 3, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0101E022
CloseHandle.KERNELBASE(?,?,?,01034F20,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 0101E04D
#800.MFC42U(?,?,01034F20,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0101E063

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800CloseH_prologHandle
String ID:
API String ID: 3138414786-0
Opcode ID: fac1d103e742ff40a65a6e0a4812efe650d29c4497a7e4b5fb176ba42ada2fe0
Instruction ID: a86aa596d2ecaa0046357f96590b51328c1b5bfe60d2572573728a51294e2e2a
Opcode Fuzzy Hash: fac1d103e742ff40a65a6e0a4812efe650d29c4497a7e4b5fb176ba42ada2fe0
Instruction Fuzzy Hash: 8DF0FE705107969BDB2AEF64C4047EDB7E8BF49315F00464DE4E6A7284CB749A44CB50

Function 01038174 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01038179
#823.MFC42U(?,?,00000002,00000000,?,0103BCD4,00000000,00000000,01001510,00000003), ref: 010381B5

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #823H_prolog
String ID:
API String ID: 1233609670-0
Opcode ID: 67a176a756792668257d90ea2e0d7f8ed2859fe0ecd7c7ad72d9067d3d95feca
Instruction ID: b0614bf7efe9057625286bad131c120ef6ba0968d2fa5827810f553c3a27496f
Opcode Fuzzy Hash: 67a176a756792668257d90ea2e0d7f8ed2859fe0ecd7c7ad72d9067d3d95feca
Instruction Fuzzy Hash: 9301B5B2B002149BE7109F59CDC1A9ABBE9FBD8354F14827EF589EB240D634D9058690

Function 010330B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010330B5
??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ.MSVCP60(?,?,01033164,01001510,01034214,0104E430,?,00000001,?,010014DC,00000001,00000000,00000000,/playfile,00000004,00000000), ref: 010330D7

Part of subcall function 0101D34C: __EH_prolog.LIBCMT ref: 0101D351
Part of subcall function 0101D34C: #825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D374
Part of subcall function 0101D34C: #825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D382
Part of subcall function 0101D34C: #800.MFC42U(00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000,01001510), ref: 0101D38F

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #825H_prolog$#800??1?$basic_stringstream@G@2@@std@@G@std@@U?$char_traits@V?$allocator@
String ID:
API String ID: 511623413-0
Opcode ID: c18c9dcafbfb130a8c9274d6005d0c760a472eb302745ac4c1f713fe41800ff4
Instruction ID: f12a90bbe742e7487b3adc24e16da044e187349deb0ec630fedd8506760196b9
Opcode Fuzzy Hash: c18c9dcafbfb130a8c9274d6005d0c760a472eb302745ac4c1f713fe41800ff4
Instruction Fuzzy Hash: C8E06D719105169BDB19DB58C4557ECB3B4FB14721F00826D90D2D2190DBB81A05CB40

Function 0103CD59 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

WriteConsoleOutputW.KERNELBASE(?,?,?,0103D0E9,?,?,?,?,0103D0E9), ref: 0103CD9A

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: ConsoleOutputWrite
String ID:
API String ID: 1925201070-0
Opcode ID: 35e4cbd013c08e8daf754a23d3175324fb9a1873c4b053f35149b397b909c0fd
Instruction ID: 245d94acecfb5f2fd43c767d85bc6a22b4aec77f8407c264c4d815bfde70957f
Opcode Fuzzy Hash: 35e4cbd013c08e8daf754a23d3175324fb9a1873c4b053f35149b397b909c0fd
Instruction Fuzzy Hash: 2EF0AC2881020DFACF01DBE4D5054ADBBB5FF58304F109198D41467221E3768616DB5A

Function 01023900 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

#825.MFC42U(?,00000000,?,01001510,01023943,?,0101E365,?,?,01034EE4,01001510,00000000,?,00000000,?,?), ref: 01023916

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #825
String ID:
API String ID: 41483190-0
Opcode ID: 8695959943596611f5a34923991a1fca96a519ef5066326c352ec3af40d77b93
Instruction ID: d512104d8d4c3719dd779b02f2dded6857a04432ac85704d627c30cd0ec5b01e
Opcode Fuzzy Hash: 8695959943596611f5a34923991a1fca96a519ef5066326c352ec3af40d77b93
Instruction Fuzzy Hash: E3D0A5777016215ED6345AF8D8C05D7A3F9D7CA321714053FE5C797010C95568C6D390

Function 0103CC63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetConsoleActiveScreenBuffer.KERNELBASE(?,0103BA91,00000001,00000001), ref: 0103CC6B

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: ActiveBufferConsoleScreen
String ID:
API String ID: 1715499361-0
Opcode ID: 605ca0f679ebc9d36e76afcb886cc5294a52e30d76024136ea46c9071c920119
Instruction ID: 6884c20ae6a3b49ebb770c1c5414c03f428639912fe029315b37fb226a2129e9
Opcode Fuzzy Hash: 605ca0f679ebc9d36e76afcb886cc5294a52e30d76024136ea46c9071c920119
Instruction Fuzzy Hash: 66B012306001004BEF54CF36964CA01779CAA403013100484E440D1000C636C002CA10

Function 0101C992 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,01036060,00000000,00004E1F,00000000,00000000,0105328C), ref: 0101C994

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f0098cac61d17f31c8a9537c91a8d3dc4dfcd546e8461efca5c2631b9b8ee15d
Instruction ID: 9442111cc37d23fed9fcedd4f0e4449de83cf3ae5fe1a624aea0ca7f6a4fbc22
Opcode Fuzzy Hash: f0098cac61d17f31c8a9537c91a8d3dc4dfcd546e8461efca5c2631b9b8ee15d
Instruction Fuzzy Hash:

Non-executed Functions

Function 01031DDF Relevance: 79.1, APIs: 37, Strings: 8, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01031DE4

Part of subcall function 01030D8B: __EH_prolog.LIBCMT ref: 01030D90

#540.MFC42U(01001510,0000002B,00000002,00000000), ref: 01031E62
#925.MFC42U(?,0000002B,\*.*,01001510,0000002B,00000002,00000000), ref: 01031E77
#858.MFC42U(00000000,?,0000002B,\*.*,01001510,0000002B,00000002,00000000), ref: 01031E87
#800.MFC42U(00000000,?,0000002B,\*.*,01001510,0000002B,00000002,00000000), ref: 01031E96
#2910.MFC42U(00000000,00000000,?,0000002B,\*.*,01001510,0000002B,00000002,00000000), ref: 01031EA2
wcslen.MSVCRT ref: 01031EAE
#2910.MFC42U(00000000), ref: 01031F02
wcslen.MSVCRT ref: 01031F08
#823.MFC42U(?), ref: 01031F0F
GetLastError.KERNEL32(CDir::Traverse FindFirstFile memory exhausted), ref: 01031F29
_CxxThrowException.MSVCRT(?,010414A0), ref: 01031F47
#2910.MFC42U(00000000), ref: 01031F68
swprintf.MSVCRT(00000000,\\?\%s,00000000,00000000), ref: 01031F8A

Strings

--- DEBUG CDir::Traverse invalid handle value Detected = , xrefs: 01031FE4, 01031FE9, 0103200E
--- DEBUG CDir::Traverse Long fil name detected FindFirstFileW with = , xrefs: 01031FA3
\\?\%s, xrefs: 01031F84
CDir::Traverse FindFirstFile memory exhausted, xrefs: 01031F24
\*.*, xrefs: 01031E67
: Path is in this excluded path list, xrefs: 01031E2E, 010321EA
--- DEBUG CDir::Traverse Len is = , xrefs: 01031ECD
\\?\UNC%s, xrefs: 01031F70

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910$H_prologwcslen$#540#800#823#858#925ErrorExceptionLastThrowswprintf
String ID: : Path is in this excluded path list$--- DEBUG CDir::Traverse Len is = $--- DEBUG CDir::Traverse Long fil name detected FindFirstFileW with = $--- DEBUG CDir::Traverse invalid handle value Detected = $CDir::Traverse FindFirstFile memory exhausted$\*.*$\\?\%s$\\?\UNC%s
API String ID: 2743624601-2986437013
Opcode ID: 32719f94cdd2a6eeb59a8264d0311c54941e358dce1df26f9d06c290c5612125
Instruction ID: 01df9da53477cfa2b76c6f034a8a62cd2e942ce32ae997cf97ae88dab3bf4818
Opcode Fuzzy Hash: 32719f94cdd2a6eeb59a8264d0311c54941e358dce1df26f9d06c290c5612125
Instruction Fuzzy Hash: 11D1CE74904205DFDB25EBA4CC8CBE9B7B9BF99300F1081D9E48A97291DB359A85CF60

Function 0103172D Relevance: 66.8, APIs: 32, Strings: 6, Instructions: 289fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01031732
#540.MFC42U(01001510,00000002,00000000), ref: 01031750
#922.MFC42U(?,0000002B,00000002,01001510,00000002,00000000), ref: 01031769
#858.MFC42U(00000000,?,0000002B,00000002,01001510,00000002,00000000), ref: 01031779
#800.MFC42U(00000000,?,0000002B,00000002,01001510,00000002,00000000), ref: 01031787
#2910.MFC42U(00000000,00000000,?,0000002B,00000002,01001510,00000002,00000000), ref: 01031793
wcslen.MSVCRT ref: 01031799
#2910.MFC42U(00000000), ref: 010317F5
wcslen.MSVCRT ref: 010317FB
#823.MFC42U(?), ref: 01031806
GetLastError.KERNEL32(CDir::FindOneLevel FindFirstFile memory exhausted), ref: 0103181C
_CxxThrowException.MSVCRT(?,010414A0), ref: 0103183A
#2910.MFC42U(00000000), ref: 0103185C
#2910.MFC42U(00000000), ref: 01031873
swprintf.MSVCRT(?,\\?\%s,00000000,00000000), ref: 01031884
FindFirstFileW.KERNEL32(?,?), ref: 010318C8
GetLastError.KERNEL32 ref: 01031920
#825.MFC42U(?), ref: 01031943
#2910.MFC42U(00000000,?), ref: 01031954
FindFirstFileW.KERNEL32(00000000,00000000,?), ref: 0103195A
#800.MFC42U ref: 01031B19

Strings

--- DEBUG CDir::FindOneLevel invalid handle value Detected = , xrefs: 010317E2, 010318EA, 01031914, 01031938, 01031984
\\?\%s, xrefs: 01031879
--- DEBUG CDir Long fil name detected FindFirstFileW with = , xrefs: 0103189E
CDir::FindOneLevel FindFirstFile memory exhausted, xrefs: 01031817
--- DEBUG CDir::FindOneLevel Len is = , xrefs: 010317BB
\\?\UNC%s, xrefs: 01031864

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910$#800ErrorFileFindFirstLastwcslen$#540#823#825#858#922ExceptionH_prologThrowswprintf
String ID: --- DEBUG CDir Long fil name detected FindFirstFileW with = $--- DEBUG CDir::FindOneLevel Len is = $--- DEBUG CDir::FindOneLevel invalid handle value Detected = $CDir::FindOneLevel FindFirstFile memory exhausted$\\?\%s$\\?\UNC%s
API String ID: 455009594-1669374406
Opcode ID: 2a4cf2c249a7cd054c043a2d960c77bd9c24ac0113776edc6f0ac588f83be0fa
Instruction ID: 45886c4a41ab09176a942ca53335d878ad8c2d8b13ccdb4ce094fe4f4ebaa456
Opcode Fuzzy Hash: 2a4cf2c249a7cd054c043a2d960c77bd9c24ac0113776edc6f0ac588f83be0fa
Instruction Fuzzy Hash: 60C19F74A04219DFDB25EBA4CC8CBE9B7B9FF48301F1041D9E58AA7190DB359A85CF50

Function 0103DEE7 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,000002CC,?,00000050), ref: 0103DF95
UnhandledExceptionFilter.KERNEL32(?), ref: 0103DF9F
GetCurrentProcess.KERNEL32(00000502), ref: 0103DFAA
TerminateProcess.KERNEL32(00000000), ref: 0103DFB1

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 03277f9cf9057e1043f6bccf3809ef4857170c843ba3c9cd5a4655968c416843
Instruction ID: aad7b9ec148d65668f5d2249d9a741eda1e0cdc3151308440315c7d6875efbd5
Opcode Fuzzy Hash: 03277f9cf9057e1043f6bccf3809ef4857170c843ba3c9cd5a4655968c416843
Instruction Fuzzy Hash: 7411E6B590020DDFDB21EFA5D989BDDBBFCBB09305F40411AE985AB244EB7596048F21

Function 010232DE Relevance: 115.8, APIs: 62, Strings: 4, Instructions: 339COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010232E3
#861.MFC42U(010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 010232F7
#861.MFC42U(HKEY_CURRENT_USER,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023315
#861.MFC42U(HKEY_LOCAL_MACHINE,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023329
#540.MFC42U(010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 0102333B
#540.MFC42U(010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023346
#4273.MFC42U(?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023358
#800.MFC42U(00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 0102336D
#861.MFC42U(010014DC,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 0102337E
#2910.MFC42U(00000000,010014DC,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 0102338A
#858.MFC42U(?,00000000,010014DC,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 010233B2
#861.MFC42U(010014DC,?,00000000,010014DC,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 010233BE
#4272.MFC42U(?,00000001,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023425
#858.MFC42U(00000000,?,00000001,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023431
#800.MFC42U(00000000,?,00000001,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 0102343D
#535.MFC42U(?,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023446
#4199.MFC42U(?,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023452
#2756.MFC42U(HKEY_LOCAL_MACHINE,?,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023460
#861.MFC42U(HKEY_LOCAL_MACHINE,HKEY_LOCAL_MACHINE,?,00000000,01003608,?,00000000,00000002,010014DC,00000000,0000001F,00000000,00000000,?,00000002), ref: 01023474
wcslen.MSVCRT ref: 0102347A
#4272.MFC42U(?,00000001), ref: 01023489
#858.MFC42U(00000000,?,00000001), ref: 01023495
#800.MFC42U(00000000,?,00000001), ref: 010234A1

Strings

HKEY_CLASSES_ROOT, xrefs: 0102352C, 01023540, 01023545, 01023552
HKEY_LOCAL_MACHINE, xrefs: 01023324, 01023457, 0102345C, 01023469, 01023479, 0102357D
HKEY_CURRENT_USER, xrefs: 01023310, 010234AB, 010234B0, 010234BD, 010234CD, 01023587
HKEY_USERS, xrefs: 010234E8, 010234F9, 010234FE, 0102350E

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #861$#800#858$#4272#540$#2756#2910#4199#4273#535H_prologwcslen
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 4020397084-771094874
Opcode ID: 493fd0256ae5996a6be496043cbe814ef4bef1199dcc2d6b0bc7147cac5a4bdb
Instruction ID: 16000be7bf4227ef4cba68cfad3a65ce330edaa7ed87292315418e3b662091a1
Opcode Fuzzy Hash: 493fd0256ae5996a6be496043cbe814ef4bef1199dcc2d6b0bc7147cac5a4bdb
Instruction Fuzzy Hash: 09C1A87150015AEEDB15EFA4C894BEFBBBDAFA8300F04804DF98597281DF789A45CB61

Function 010378A2 Relevance: 112.4, APIs: 58, Strings: 6, Instructions: 405COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010378A7
GetStdHandle.KERNEL32(000000F5,00000004,?,00000000), ref: 010378EC
GetStdHandle.KERNEL32(000000F6), ref: 010378F0
#823.MFC42U(00000044), ref: 01037908
#540.MFC42U ref: 0103791A
#2810.MFC42U(?,%2.2d) %25s - %s,00000000,01018BD4,01018B20), ref: 0103796B
#2910.MFC42U(00000000), ref: 0103797D
#2910.MFC42U(00000000), ref: 010379B8
#2910.MFC42U(00000000), ref: 010379D4
ReadConsoleW.KERNEL32(?,?,00001387,?,00000000,00000001), ref: 01037A0D
swscanf.MSVCRT ref: 01037A33
swscanf.MSVCRT ref: 01037A5B
wcsncpy.MSVCRT ref: 01037A86
#538.MFC42U(?), ref: 01037A96
#6278.MFC42U(?), ref: 01037AA5
#6278.MFC42U(?), ref: 01037AB0
#4272.MFC42U(?,00000001,?), ref: 01037B08
#858.MFC42U(00000000,?,00000001,?), ref: 01037B18
#800.MFC42U(00000000,?,00000001,?), ref: 01037B27
#6278.MFC42U(00000000,?,00000001,?), ref: 01037B32
#2910.MFC42U(00000000,00000000,?,00000001,?), ref: 01037B4D
wcscmp.MSVCRT ref: 01037B83
wcscmp.MSVCRT ref: 01037B9A
wcscmp.MSVCRT ref: 01037BBB
wcscmp.MSVCRT ref: 01037BCE
wcscpy.MSVCRT ref: 01037BDC
_wcsicmp.MSVCRT ref: 01037BFA
_wcsicmp.MSVCRT ref: 01037C0D
#538.MFC42U(0101A0B0), ref: 01037C24
#538.MFC42U(010014DC,0101A0B0), ref: 01037C38
#858.MFC42U(00000000,?,010014DC,0101A0B0), ref: 01037C58
#800.MFC42U(00000000,?,010014DC,0101A0B0), ref: 01037C67
#2910.MFC42U(00000000,00000000,?,010014DC,0101A0B0), ref: 01037C76
#800.MFC42U ref: 01037CB7
#800.MFC42U ref: 01037CC5
#538.MFC42U(01003EF8), ref: 01037CF0
#922.MFC42U(?,00000000,?,01003EF8), ref: 01037D08
#858.MFC42U(00000000,?,00000000,?,01003EF8), ref: 01037D18
#800.MFC42U(00000000,?,00000000,?,01003EF8), ref: 01037D27
#538.MFC42U(010028B4), ref: 01037D5B
#922.MFC42U(?,00000000,?,010028B4), ref: 01037D73
#858.MFC42U(00000000,?,00000000,?,010028B4), ref: 01037D83
#800.MFC42U(00000000,?,00000000,?,010028B4), ref: 01037D92
#4272.MFC42U(?,00000001), ref: 01037DAE
#927.MFC42U(?,010028B4,00000000,?,00000001), ref: 01037DC4
#858.MFC42U(00000000,?,010028B4,00000000,?,00000001), ref: 01037DD4
#800.MFC42U(00000000,?,010028B4,00000000,?,00000001), ref: 01037DE3
#800.MFC42U(00000000,?,010028B4,00000000,?,00000001), ref: 01037DF2
#2910.MFC42U(00000000,00001387), ref: 01037E04
wcsncpy.MSVCRT ref: 01037E0B
#2910.MFC42U(00000000,00001387), ref: 01037E23
wcsncpy.MSVCRT ref: 01037E2A
#825.MFC42U(?), ref: 01037E3F
#800.MFC42U ref: 01037E4F
#800.MFC42U ref: 01037E5E
#825.MFC42U(?), ref: 01037E92
#800.MFC42U ref: 01037EA2
#800.MFC42U ref: 01037EB1

Strings

option, xrefs: 01037C02
%s%s, xrefs: 01037A2D
options, xrefs: 01037BEF
/apply, xrefs: 01037BD6
SubInAcl.exe, xrefs: 01037B62
%2.2d) %25s - %s, xrefs: 01037965

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#2910$#538#858$wcscmp$#6278wcsncpy$#4272#825#922Handle_wcsicmpswscanf$#2810#540#823#927ConsoleH_prologReadwcscpy
String ID: %2.2d) %25s - %s$%s%s$/apply$SubInAcl.exe$option$options
API String ID: 2754923417-761740641
Opcode ID: 97ce954ce236b84c893366c83ee4b243d6d7c74b80eeb33232c36eb76eebbca6
Instruction ID: 50e417a65d285a297ce2b31590fcc6bcf4f1a86c34d1450e3bd54f29fb55e078
Opcode Fuzzy Hash: 97ce954ce236b84c893366c83ee4b243d6d7c74b80eeb33232c36eb76eebbca6
Instruction Fuzzy Hash: 75F17E70900259DEDB25EB64CD84BEDB7BAAFA5314F0001D9E489A3181DF365FA8CF61

Function 0102FB92 Relevance: 63.3, APIs: 30, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0102FB97
#861.MFC42U(010014DC,00000001,00000002,00000001), ref: 0102FBCA
wcscpy.MSVCRT ref: 0102FBE5
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0102FBEE
swprintf.MSVCRT(?,%lu,?), ref: 0102FC2B
swprintf.MSVCRT(?,0x%02hx%02hx%02hx%02hx%02hx%02hx,?,?,?,?,?,?), ref: 0102FC5F
wcscat.MSVCRT ref: 0102FC76
GetSidSubAuthorityCount.ADVAPI32(?), ref: 0102FC7F
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 0102FC9E
swprintf.MSVCRT(?,-%lu,00000000), ref: 0102FCB2
wcscat.MSVCRT ref: 0102FCC6
#538.MFC42U(?), ref: 0102FCF3
#4197.MFC42U(?), ref: 0102FD35
#858.MFC42U(?,?,010014DC,?,?,?), ref: 0102FDA4
#861.MFC42U(?,?,010014DC,?,?,?), ref: 0102FDC4
SetLastError.KERNEL32(00000539,?,?,010014DC,?,?,?), ref: 0102FDD9
#800.MFC42U(?,?,010014DC,?,?,?), ref: 0102FDEB
#800.MFC42U(?,?,010014DC,?,?,?), ref: 0102FDFA
#800.MFC42U(?,010014DC,?,?,?), ref: 0102FE10
#800.MFC42U(?,010014DC,?,?,?), ref: 0102FE1F
#861.MFC42U(010014DC,?,010014DC,00000001,00000002,00000001), ref: 0102FE56
#535.MFC42U(?,?,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 0102FE85
#535.MFC42U(?,?,?,?,?,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 0102FF09
#800.MFC42U(?,?,?,?,?,?,?,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 0102FF34
#800.MFC42U(?,?,?,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 0102FF48
#538.MFC42U(010014DC,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 0102FF68
#800.MFC42U(?,010014DC,?,?,?,?,010014DC,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 0102FFF4
#800.MFC42U(?,010014DC,?,?,?,?,010014DC,?,010014DC,?,?,?,010014DC,00000001,00000002,00000001), ref: 01030003
#535.MFC42U(?,?,?,010014DC,?,?,?,?,010014DC,?,010014DC,?,?,?,010014DC,00000001), ref: 01030023
#800.MFC42U(?,?,?,?,010014DC,?,?,?,?,010014DC,?,010014DC,?,?,?,010014DC), ref: 0103003A

Strings

-%lu, xrefs: 0102FCAC
--- DEBUG SidFactory::LookupSid Found = , xrefs: 0102FD75
--- DEBUG SidFactory::LookupSid using OffLine sam = , xrefs: 0102FD0D
s-1-, xrefs: 0102FBDF
0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 0102FC59
%lu, xrefs: 0102FC25

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#535#861Authorityswprintf$#538wcscat$#4197#858CountErrorH_prologIdentifierLastwcscpy
String ID: %lu$-%lu$--- DEBUG SidFactory::LookupSid Found = $--- DEBUG SidFactory::LookupSid using OffLine sam = $0x%02hx%02hx%02hx%02hx%02hx%02hx$s-1-
API String ID: 2709720098-1033418872
Opcode ID: 192b4c4355228dc9b4ab999ff00a1216eb25a7b661781539bc77894e3dae3e78
Instruction ID: a7f61f5ddba80f1e41dfe1443fabb228607f66be8959cf4595513810a06390d3
Opcode Fuzzy Hash: 192b4c4355228dc9b4ab999ff00a1216eb25a7b661781539bc77894e3dae3e78
Instruction Fuzzy Hash: F5D190B190022A9FDF65DF64C884BEDB7B9BF59304F4044E9E59A97181DB349B88CF20

Function 01030F08 Relevance: 61.5, APIs: 27, Strings: 8, Instructions: 277COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01030F0D

Part of subcall function 0101CB5C: __EH_prolog.LIBCMT ref: 0101CB61
Part of subcall function 0101CB5C: #538.MFC42U(010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CB7F
Part of subcall function 0101CB5C: #823.MFC42U(0001E002,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBA3
Part of subcall function 0101CB5C: #823.MFC42U(0001E002,0001E002,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBAC
Part of subcall function 0101CB5C: GetStdHandle.KERNEL32(000000F5,010014DC,00000001,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBCA
Part of subcall function 0101CB5C: GetStdHandle.KERNEL32(000000F5,?,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBD8
Part of subcall function 0101CB5C: GetConsoleScreenBufferInfo.KERNELBASE(00000000,?,00000001,00000000,/playfile,00000004,00000000), ref: 0101CBDB

Part of subcall function 0101CCD2: _wfopen.MSVCRT ref: 0101CCDE
Part of subcall function 0101CCD2: ??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z.MSVCP60(File Format Error), ref: 0101CD03
Part of subcall function 0101CCD2: SetLastError.KERNEL32(000003EE), ref: 0101CD10

#861.MFC42U(00000002,00000002,0100A628,00000000,=both,00000002,0103A6CD,00000000,00000000,0000003D,=both,00000000,00000000,00000000,00000000,00000000), ref: 01030F97
#540.MFC42U(00000002,00000002,0100A628,00000000,=both,00000002,0103A6CD,00000000,00000000,0000003D,=both,00000000,00000000,00000000,00000000,00000000), ref: 01030FA8
#861.MFC42U(?,?,00001387,00000002,00000002,0100A628,00000000,=both,00000002,0103A6CD,00000000,00000000,0000003D,=both,00000000,00000000), ref: 01030FE2
#4197.MFC42U(?,?,00001387,00000002,00000002,0100A628,00000000,=both,00000002,0103A6CD,00000000,00000000,0000003D,=both,00000000,00000000), ref: 01030FED
#6278.MFC42U(?,?,00001387,00000002,00000002,0100A628,00000000,=both,00000002,0103A6CD,00000000,00000000,0000003D,=both,00000000,00000000), ref: 01030FF8
#6279.MFC42U(?,?,00001387,00000002,00000002,0100A628,00000000,=both,00000002,0103A6CD,00000000,00000000,0000003D,=both,00000000,00000000), ref: 01031003
#2755.MFC42U ref: 01031027
#2910.MFC42U(00000000), ref: 0103103A
wcscmp.MSVCRT ref: 01031054
#538.MFC42U(=s-1-9-6-4), ref: 0103106F
#940.MFC42U(00000000,=s-1-9-6-4), ref: 0103107F
#800.MFC42U(00000000,=s-1-9-6-4), ref: 0103108E
#2755.MFC42U(?,00000000,=s-1-9-6-4), ref: 0103109C
#4124.MFC42U(?,00000000), ref: 010310B1
#4272.MFC42U(?,00000001,?,00000000), ref: 010310C9
wcsncmp.MSVCRT ref: 010310E5

Part of subcall function 0101D247: fclose.MSVCRT ref: 0101D25A
Part of subcall function 0101D247: #861.MFC42U(010014DC,00000001,?,0101D36C,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134), ref: 0101D274

Part of subcall function 0101D34C: __EH_prolog.LIBCMT ref: 0101D351
Part of subcall function 0101D34C: #825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D374
Part of subcall function 0101D34C: #825.MFC42U(?,00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000), ref: 0101D382
Part of subcall function 0101D34C: #800.MFC42U(00000000,?,0103BC6E,?,?,?,00000004,?,?,0101B0F8,action|?> ,0101B134,00000000,00000000,00000000,01001510), ref: 0101D38F

Strings

=both, xrefs: 01030F25
__cachefileonly__, xrefs: 01031049
Can't open account mapping file, xrefs: 01030F5F
is invalid. Mapping File has not a valid form, xrefs: 01031250, 010312B8
--- DEBUG map file adding = , xrefs: 01031124, 01031129, 01031154
s-1-, xrefs: 010310DA
is empty !, xrefs: 01031207
=s-1-9-6-4, xrefs: 01031064

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #861H_prolog$#2755#538#800#823#825Handle$#2910#4124#4197#4272#540#6278#6279#940??6std@@BufferConsoleErrorG@std@@@0@InfoLastScreenU?$char_traits@V10@V?$basic_ostream@_wfopenfclosewcscmpwcsncmp
String ID: is empty !$ is invalid. Mapping File has not a valid form$--- DEBUG map file adding = $=both$=s-1-9-6-4$Can't open account mapping file$__cachefileonly__$s-1-
API String ID: 231311703-2091655046
Opcode ID: e2fbbd9c802960ffc01ae38eee94286eb3e41b18615ae041f66345f589140610
Instruction ID: d227fb76a4ced851610ae91359a9fc6c4f10855f8946d4f09752984a3147b1e8
Opcode Fuzzy Hash: e2fbbd9c802960ffc01ae38eee94286eb3e41b18615ae041f66345f589140610
Instruction Fuzzy Hash: F2C18071A04215DFDF2AEBA4C99CADDB7B9FFA8340F0040D9E44A97290DB749A85CF50

Function 0103BA24 Relevance: 50.9, APIs: 24, Strings: 5, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0103BA29

Strings

SubInAcl.exe , xrefs: 0103BA99
/noverbose , xrefs: 0103BAB5
/testmode , xrefs: 0103BACA
action|?> , xrefs: 0103BC0A
object_type|?> , xrefs: 0103BC00

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: H_prolog
String ID: SubInAcl.exe $/noverbose $/testmode $action|?> $object_type|?>
API String ID: 3519838083-4147986655
Opcode ID: 877eaaaa5946a4334067556388f332bcc488c7ec9f0063009594c9912d8c5bed
Instruction ID: 9b0a0b917a65a6ffde1deaa7690371f33fba478be2c5f0129ee0e01919a69123
Opcode Fuzzy Hash: 877eaaaa5946a4334067556388f332bcc488c7ec9f0063009594c9912d8c5bed
Instruction Fuzzy Hash: 2461AE7050024AEFCB15EFA4C9949EEB778BFA4304F00815DF9D26B281DB749B45CB62

Function 01035405 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0103540A
#535.MFC42U(?,00000000), ref: 01035458
#4197.MFC42U(?,00000000), ref: 01035463
#535.MFC42U(?,01001510,?,?,00000000), ref: 0103548E
#535.MFC42U(?,?,01001510,?,?,00000000), ref: 0103549E
#538.MFC42U(010014DC,?,?,01001510,?,?,00000000), ref: 010354AF
#4124.MFC42U(?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010354C5
#940.MFC42U(00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010354D2
#800.MFC42U(00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010354DE
#940.MFC42U(00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010354F0
#4272.MFC42U(?,00000002,00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 0103550A
#858.MFC42U(00000000,?,00000002,00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 01035517
#800.MFC42U(00000000,?,00000002,00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 01035523
#4272.MFC42U(?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510), ref: 0103553E
#858.MFC42U(00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510), ref: 0103554B
#800.MFC42U(00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000,00000000,010014DC,?,?,01001510), ref: 01035557
#2910.MFC42U(00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355C4
#2756.MFC42U(00000000,00000000,010014DC,?,?,01001510,?,?,00000000), ref: 010355CD
#922.MFC42U(?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000,00000000), ref: 010355E9
#858.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 010355F6
#800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035602
#800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103560E
#800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 0103561A
#800.MFC42U(00000000,?,?,?,00000000,00000000,00000000,?,00000002,00000000,?,00000002,00000004,00000000,?,00000000), ref: 01035625
#800.MFC42U(?,00000000), ref: 01035648

Strings

--- DEBUG WndToDosChar - Left = , xrefs: 0103556C
--- DEBUG WndToDosChar - Right = , xrefs: 0103559C
--- DEBUG WndToDosChar - Analysing = , xrefs: 01035428

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#535#858$#4272#940$#2756#2910#4124#4197#538#922H_prolog
String ID: --- DEBUG WndToDosChar - Analysing = $--- DEBUG WndToDosChar - Left = $--- DEBUG WndToDosChar - Right =
API String ID: 771657224-3861376133
Opcode ID: 4ffaf2aad40b9a5d7e3839afb6f3e395ebd948af400bde22d6448f98d3988d2b
Instruction ID: 5321866894d178501ee797d6d0982233d8c6e686acca8276e9189e49f61ee5b5
Opcode Fuzzy Hash: 4ffaf2aad40b9a5d7e3839afb6f3e395ebd948af400bde22d6448f98d3988d2b
Instruction Fuzzy Hash: 4971D57590024ADFCB05DFE4C9C8DEEF7B8BF68304F104158E482A7291DB38AA44CB61

Function 01031477 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0103147C
#535.MFC42U(00000002,01001510,00000002,00000000,0103C9E6,?,00000001,00000002,?,?,?,?,?,?,00000002,?), ref: 010314B5
#538.MFC42U(010014DC,00000002,01001510,00000002,00000000,0103C9E6,?,00000001,00000002,?,?,?,?,?,?,00000002), ref: 010314C5
#5706.MFC42U(?,00000002,010014DC,00000002,01001510,00000002,00000000,0103C9E6,?,00000001,00000002,?,?,?,?,?), ref: 010314F1

Part of subcall function 0101D5D4: wcscmp.MSVCRT ref: 0101D5DE

#5706.MFC42U(?,00000003,00000000,0100A734,?,00000002,010014DC,00000002,01001510,00000002,00000000,0103C9E6,?,00000001,00000002,?), ref: 0103151E
#800.MFC42U(00000000,0100A734,?,00000002,010014DC,00000002,01001510,00000002,00000000,0103C9E6,?,00000001,00000002,?,?,?), ref: 0103158C
#800.MFC42U(00000000,0100A734,?,00000002,010014DC,00000002,01001510,00000002,00000000,0103C9E6,?,00000001,00000002,?,?,?), ref: 010315A7
#2910.MFC42U(00000000,00000A28,?,?,00000000,0100A734,?,00000002,010014DC,00000002,01001510,00000002,00000000,0103C9E6,?,00000001), ref: 010315D4
GetFullPathNameW.KERNEL32(00000000,00000000,00000A28,?,?,00000000,0100A734,?,00000002,010014DC,00000002,01001510,00000002,00000000,0103C9E6,?), ref: 010315DA
#861.MFC42U(?), ref: 010315E9
wcslen.MSVCRT ref: 010315F5
#942.MFC42U(0100A728), ref: 01031612
#538.MFC42U(\*.*,0100A728), ref: 01031622
#858.MFC42U(00000001,\*.*,?), ref: 01031635
#800.MFC42U(00000001,\*.*,?), ref: 01031644
#861.MFC42U(?), ref: 01031669
#538.MFC42U(\*.*,?), ref: 01031679
#538.MFC42U(?), ref: 010316A0
#858.MFC42U(?,?), ref: 010316B3
#800.MFC42U(?,?), ref: 010316C2
#538.MFC42U(\*.*), ref: 010316D8
#858.MFC42U(?,\*.*), ref: 010316EB
#800.MFC42U(?,\*.*), ref: 010316FA
#861.MFC42U(?,?,\*.*), ref: 01031708

Strings

\, xrefs: 01031601
\*.*, xrefs: 01031617, 0103166E, 010316D3
\.., xrefs: 01031523

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #538#800$#858#861$#5706$#2910#535#942FullH_prologNamePathwcscmpwcslen
String ID: \$\*.*$\..
API String ID: 2067452352-3708544505
Opcode ID: 42b082a62f2e53eacb425dc46fe34b6195d295347964c6a4644ae588c685ca96
Instruction ID: c5a0e169107e17b99bcedf2037fbb8720908ee929f7e346c7d7ce89652a26569
Opcode Fuzzy Hash: 42b082a62f2e53eacb425dc46fe34b6195d295347964c6a4644ae588c685ca96
Instruction Fuzzy Hash: 90716370900359DADB11EB94CD84AEDB7FDAFA9308F4440CDE0C9A71A1DB745A89DF22

Function 0102E91D Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 0101D5F3: wcscmp.MSVCRT ref: 0101D5FD

#2910.MFC42U(00000000,?,010014DC,010014DC,?), ref: 0102E9AB
LookupAccountSidW.ADVAPI32(00000000,?,?,?,?,?,?), ref: 0102E9D0
#861.MFC42U(?), ref: 0102EA19
#942.MFC42U(01001514,?), ref: 0102EA25
#861.MFC42U(010014DC), ref: 0102EA2F
#942.MFC42U(?,010014DC), ref: 0102EA3D
#4197.MFC42U(?,010014DC), ref: 0102EA44
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0102EA72
swprintf.MSVCRT(?,%lu,?), ref: 0102EAB4
swprintf.MSVCRT(?,0x%02hx%02hx%02hx%02hx%02hx%02hx,?,?,?,?,?,?), ref: 0102EAE5
wcscat.MSVCRT ref: 0102EAFF
GetSidSubAuthorityCount.ADVAPI32(?), ref: 0102EB04
GetSidSubAuthority.ADVAPI32(?,?), ref: 0102EB19
swprintf.MSVCRT(?,-%lu,00000000), ref: 0102EB2D
wcscat.MSVCRT ref: 0102EB41
#861.MFC42U(?), ref: 0102EB5B

Strings

Unknown account, xrefs: 0102E93F
-%lu, xrefs: 0102EB27
Unknown domain, xrefs: 0102E966
0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 0102EADF
S-1-, xrefs: 0102EA51
%lu, xrefs: 0102EAAE

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #861Authorityswprintf$#942wcscat$#2910#4197AccountCountIdentifierLookupwcscmp
String ID: %lu$-%lu$0x%02hx%02hx%02hx%02hx%02hx%02hx$S-1-$Unknown account$Unknown domain
API String ID: 3435155560-3424802845
Opcode ID: 7599b4e38a3ea3f5685486d3ae76c153f65edc2c5523536ac211f40b9b4941ed
Instruction ID: c5f4dca0a28dcbeafc8390bffc43759b4cfdef0e92e6bb62d4a1e4f2578d9af5
Opcode Fuzzy Hash: 7599b4e38a3ea3f5685486d3ae76c153f65edc2c5523536ac211f40b9b4941ed
Instruction Fuzzy Hash: 9B61F8729401589BEF76CF68CC84FFE7BE9BB59301F18405AE5CADB192DA359604CB20

Function 01035C8C Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01035C91
GetFullPathNameW.KERNEL32(?,00001000,?,?,00000002,0000001F,00000000,01036995,?,00000000,00000000,00000002,?,00000000,01003608,00000002), ref: 01035CDD
#538.MFC42U(?), ref: 01035CF8
#2755.MFC42U(0000003A,?), ref: 01035D08
wcsncpy.MSVCRT ref: 01035D2A
QueryDosDeviceW.KERNEL32(?,?,00000258), ref: 01035D48
wcsstr.MSVCRT ref: 01035D6A
wcsncmp.MSVCRT ref: 01035D8E
swscanf.MSVCRT ref: 01035DC0
#538.MFC42U(?), ref: 01035E72
#858.MFC42U(?,?), ref: 01035E87
#800.MFC42U(?,?), ref: 01035E95
#538.MFC42U(?), ref: 01035EA7
#800.MFC42U(?), ref: 01035EB6
#538.MFC42U(?,?), ref: 01035ED4

Strings

\Device\LanmanRedirector\, xrefs: 01035D89
--- DEBUG FileFullPathName ShareName is = , xrefs: 01035E19
\Device\WinDfs\, xrefs: 01035D64
\Device\LanmanRedirector\;%[^\]\%[^\]\%s, xrefs: 01035DBA
--- DEBUG FileFullPathName Server is = , xrefs: 01035DE6
--- DEBUG FileFullPathName Default Sam Server will be = , xrefs: 01035E47

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #538$#800$#2755#858DeviceFullH_prologNamePathQueryswscanfwcsncmpwcsncpywcsstr
String ID: --- DEBUG FileFullPathName Default Sam Server will be = $--- DEBUG FileFullPathName Server is = $--- DEBUG FileFullPathName ShareName is = $\Device\LanmanRedirector\$\Device\LanmanRedirector\;%[^\]\%[^\]\%s$\Device\WinDfs\
API String ID: 2271518309-2335020397
Opcode ID: 464266803d52d5ef7859a94d67f6ffba254ae1e100b0af91990de587db40cde7
Instruction ID: 5362ea894533598d843229a2697166d2239426ddf47df248a9c07073300e4565
Opcode Fuzzy Hash: 464266803d52d5ef7859a94d67f6ffba254ae1e100b0af91990de587db40cde7
Instruction Fuzzy Hash: D86170719002099FDB25DFA4DC989DEB7B8FF88300F1444AAE546D7250EB35EA85CF60

Function 0102F5D2 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 221COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0102F5D7
#540.MFC42U(0000000A,00000000,00000000,00000003), ref: 0102F64B
#2910.MFC42U(00000000), ref: 0102F68E
ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 0102F706
#538.MFC42U(00000000), ref: 0102F716
#2910.MFC42U(00000000,?), ref: 0102F739

Part of subcall function 0102EFFF: __EH_prolog.LIBCMT ref: 0102F004
Part of subcall function 0102EFFF: #800.MFC42U(00000002,?,?,0102F74E,00000000,00000000,?), ref: 0102F031

LocalFree.KERNEL32(00000000,00000000,00000000,?), ref: 0102F751
#800.MFC42U ref: 0102F75E
#800.MFC42U ref: 0102F76A
#800.MFC42U(000000FF,?,00000000,0000000A,00000000,00000000,00000003), ref: 0102F77E
#540.MFC42U ref: 0102F7D0

Part of subcall function 0102E601: #535.MFC42U(?,?,01001510,00000000,0102FA03,?,?,?,010014DC,?,?,010014DC,010014DC,?), ref: 0102E61A

#800.MFC42U ref: 0102F84D
#800.MFC42U ref: 0102F859

Strings

not valid, xrefs: 0102F83A
__cachefileonly__, xrefs: 0102F79A
--- DEBUG Dumping Server = , xrefs: 0102F67D, 0102F6B2
--- DEBUG Dumping Server Servers Count = , xrefs: 0102F627

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#2910#540H_prolog$#535#538ConvertFreeLocalString
String ID: not valid$--- DEBUG Dumping Server = $--- DEBUG Dumping Server Servers Count = $__cachefileonly__
API String ID: 175030232-2389862082
Opcode ID: 68a23b8b5a328e147378960280e932dc1ce5f6d5aa19815e470a2915fb60b59f
Instruction ID: 620486ada5dd51b538bd4b721da2c302d1181e888909afdf1fee097ddb29d6d0
Opcode Fuzzy Hash: 68a23b8b5a328e147378960280e932dc1ce5f6d5aa19815e470a2915fb60b59f
Instruction Fuzzy Hash: 7A91A370A0025ADFDB15EFE4C488BEDB7B9BF58300F104059E446EB295DB749A45CF61

Function 01035AAF Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(NetApi32.dll,?,?,?,01035EC3,?), ref: 01035AF1
GetProcAddress.KERNEL32(00000000,NetDfsGetClientInfo), ref: 01035B06
GetLastError.KERNEL32(?,01035EC3,?), ref: 01035B35
GetLastError.KERNEL32(?,01035EC3,?), ref: 01035B76
swscanf.MSVCRT ref: 01035BA2
wcscpy.MSVCRT ref: 01035BBE
NetApiBufferFree.NETAPI32(?), ref: 01035C37

Strings

--- DEBUG NetDfsGetClientInfo Dfs path detected = , xrefs: 01035C50
--- DEBUG NetDfsGetClientInfo not existing in NetApi32.lib. DfsPath not checked = , xrefs: 01035B29
--- DEBUG NetDfsGetClientInfo DfsPath to check = , xrefs: 01035BED
NetApi32.dll, xrefs: 01035AE2
--- DEBUG NetDfsGetClientInfo NetStatus = , xrefs: 01035C17
\\%[^\]\%[^\], xrefs: 01035B97
--- DEBUG NetDfsGetClientInfo exists in NetApi32.lib. DfsPath is checked = , xrefs: 01035B6A
NetDfsGetClientInfo, xrefs: 01035B00

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: ErrorLast$AddressBufferFreeLibraryLoadProcswscanfwcscpy
String ID: --- DEBUG NetDfsGetClientInfo Dfs path detected = $--- DEBUG NetDfsGetClientInfo DfsPath to check = $--- DEBUG NetDfsGetClientInfo NetStatus = $--- DEBUG NetDfsGetClientInfo exists in NetApi32.lib. DfsPath is checked = $--- DEBUG NetDfsGetClientInfo not existing in NetApi32.lib. DfsPath not checked = $NetApi32.dll$NetDfsGetClientInfo$\\%[^\]\%[^\]
API String ID: 3944314192-1594003486
Opcode ID: b631d9c12fb69e474a2c8cfb4d9821e49a188561fb49426102d99e8ccc7daa91
Instruction ID: 017faba720cdd4a9a221edc99481ce77b9d13e14197913687c9c9506e4444d70
Opcode Fuzzy Hash: b631d9c12fb69e474a2c8cfb4d9821e49a188561fb49426102d99e8ccc7daa91
Instruction Fuzzy Hash: FF51AD74A00204DFDB659FA8D88889AB7F9FF8C705B204569E482DB255DB3AD841CF50

Function 0102F894 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0102F899

Part of subcall function 0101D5F3: wcscmp.MSVCRT ref: 0101D5FD

EqualSid.ADVAPI32(?,?,?,?,?,010014DC,010014DC,?), ref: 0102F930
#800.MFC42U(?,?,?,?,010014DC,010014DC,?), ref: 0102F970
EqualSid.ADVAPI32(?,?,?,?,?,010014DC,?,?,010014DC,010014DC,?), ref: 0102FA1C
#800.MFC42U(?,?,?,?,010014DC,?,?,010014DC,010014DC,?), ref: 0102FA52
#2910.MFC42U(00000000), ref: 0102FABF

Part of subcall function 0102E601: #535.MFC42U(?,?,01001510,00000000,0102FA03,?,?,?,010014DC,?,?,010014DC,010014DC,?), ref: 0102E61A

#2910.MFC42U(00000000), ref: 0102FAFD

Strings

--- DEBUG SidFactory::LookupList AlternateSystemName looking for = , xrefs: 0102FA6D
--- DEBUG SidFactory::LookupList- Server Found status = , xrefs: 0102FB1C
--- DEBUG SidFactory::LookupList- Server Not Found status = , xrefs: 0102FB3F
--- DEBUG SidFactory::LookupList Server looking for = , xrefs: 0102F98F
--- DEBUG SidFactory::LookupList- AlternateSystemName Found status = , xrefs: 0102FAA6
--- DEBUG SidFactory::LookupList- AlternateSystemName Not Found status = , xrefs: 0102FAE4

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910#800Equal$#535H_prologwcscmp
String ID: --- DEBUG SidFactory::LookupList AlternateSystemName looking for = $--- DEBUG SidFactory::LookupList Server looking for = $--- DEBUG SidFactory::LookupList- AlternateSystemName Found status = $--- DEBUG SidFactory::LookupList- AlternateSystemName Not Found status = $--- DEBUG SidFactory::LookupList- Server Found status = $--- DEBUG SidFactory::LookupList- Server Not Found status =
API String ID: 4220286946-1260020492
Opcode ID: c71d1dc03b8c1774e6062b6b9dda597ca4bf92dcaeda53a37c921b6fe0385bf9
Instruction ID: 1edbf2cf61ff75b38438d3d916fa62766f328e4a037df6a9a5c24033091cd1cb
Opcode Fuzzy Hash: c71d1dc03b8c1774e6062b6b9dda597ca4bf92dcaeda53a37c921b6fe0385bf9
Instruction Fuzzy Hash: E6919D75A00226DFDB65DFA8C888BADB7B5FF48345F0040E9E589A7292CB749D85CF10

Function 0101D839 Relevance: 24.5, APIs: 8, Strings: 6, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(NTDLL.DLL,?,?,00000001,?), ref: 0101D850
GetModuleHandleW.KERNEL32(NTDLL.DLL,?,?,00000001,?), ref: 0101D860
GetLastError.KERNEL32(Unable to load NTDLL,?,?,00000001,?), ref: 0101D874

Part of subcall function 0101C94A: __EH_prolog.LIBCMT ref: 0101C94F
Part of subcall function 0101C94A: #540.MFC42U(?,?,0101C9FE,00000000), ref: 0101C967

_CxxThrowException.MSVCRT(?,010414A0), ref: 0101D88C
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 0101D89D
GetProcAddress.KERNEL32(RtlUnicodeStringToAnsiString), ref: 0101D8AF
GetProcAddress.KERNEL32(NtQuerySecurityObject), ref: 0101D8C1
GetProcAddress.KERNEL32(NtSetSecurityObject), ref: 0101D8D3

Strings

NtQuerySystemInformation, xrefs: 0101D897
Unable to load NTDLL, xrefs: 0101D86F
RtlUnicodeStringToAnsiString, xrefs: 0101D89F
NtQuerySecurityObject, xrefs: 0101D8B1
NTDLL.DLL, xrefs: 0101D84A, 0101D84F, 0101D85F
NtSetSecurityObject, xrefs: 0101D8C3

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: AddressProc$#540ErrorExceptionH_prologHandleLastLibraryLoadModuleThrow
String ID: NTDLL.DLL$NtQuerySecurityObject$NtQuerySystemInformation$NtSetSecurityObject$RtlUnicodeStringToAnsiString$Unable to load NTDLL
API String ID: 380534942-3942280830
Opcode ID: 50a73bf34e8e240bf9b38ea0ae3a6e02f233c0cd291272ac595b4c00cbd178fd
Instruction ID: 247522ed9b6f23dd224688388521c6df5caf1fba07508633fb508fe186308a83
Opcode Fuzzy Hash: 50a73bf34e8e240bf9b38ea0ae3a6e02f233c0cd291272ac595b4c00cbd178fd
Instruction Fuzzy Hash: 060144F8D403146B9B365B77ED8998A3BE8EB02744700416AE8C493208FBBFD2508F40

Function 010359B7 Relevance: 22.6, APIs: 15, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010359BC
#2755.MFC42U(?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000,+subdirectories,00000004,00000000), ref: 010359CA
#4124.MFC42U(?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000,00000000), ref: 010359E9
#858.MFC42U(00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 010359F6
#800.MFC42U(00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F,0000003D,00000000), ref: 01035A02
#4272.MFC42U(00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?,0000001F), ref: 01035A10
#858.MFC42U(00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?), ref: 01035A1F
#800.MFC42U(00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004,?), ref: 01035A2B
#2910.MFC42U(00000000,00000000,00000002,00000001,00000000,?,-00000001,00000002,?,?,?,?,01036218,?,/subdirectories=,00000004), ref: 01035A35
wcslen.MSVCRT ref: 01035A3B

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800#858$#2755#2910#4124#4272H_prologwcslen
String ID:
API String ID: 2154691547-0
Opcode ID: 9067eea3a6394f6f5209ece1dd457ce6e64a4125c5fbf6c8e0357c32b9956a1c
Instruction ID: 5d74396a607cb4a712efb71573e0e798435d445290263fb1599f706edff0a9e8
Opcode Fuzzy Hash: 9067eea3a6394f6f5209ece1dd457ce6e64a4125c5fbf6c8e0357c32b9956a1c
Instruction Fuzzy Hash: 9A31717150021AEFCB14EFA4DD84AEEBB6DAF94360F004615F8A6A31D0DB349A16DB60

Function 01035661 Relevance: 21.1, APIs: 14, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01035666
#535.MFC42U(00000002,?,?,00000002,0000002B,?,?,?,00000000), ref: 01035675
#535.MFC42U(?,00000002,?,?,00000002,0000002B,?,?,?,00000000), ref: 01035685
#4197.MFC42U(?,00000002,?,?,00000002,0000002B,?,?,?,00000000), ref: 01035691
#4197.MFC42U(?,00000002,?,?,00000002,0000002B,?,?,?,00000000), ref: 01035699

Part of subcall function 0101D5D4: wcscmp.MSVCRT ref: 0101D5DE

malloc.MSVCRT ref: 010356C8
#800.MFC42U ref: 010357C1
#800.MFC42U ref: 010357CD

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #4197#535#800$H_prologmallocwcscmp
String ID:
API String ID: 3042565370-0
Opcode ID: 189f032e88418bd618ac2d1917eafe58666c7ac962c6a7ed26a5bc6532bd4e11
Instruction ID: d5b9a54cf5b4feebe9d656c6a0edf3c13a0fd386bbf35b968b39be9b9f59d377
Opcode Fuzzy Hash: 189f032e88418bd618ac2d1917eafe58666c7ac962c6a7ed26a5bc6532bd4e11
Instruction Fuzzy Hash: D441DA3180011ADFCF12EFA8DC805EEB7B9FF94314F108566E896A7160EB309A45CB91

Function 01030D8B Relevance: 21.1, APIs: 14, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01030D90
#535.MFC42U(00000002,0000002B,?,?,?,00000000), ref: 01030DB0
#4197.MFC42U(00000002,0000002B,?,?,?,00000000), ref: 01030DBB
#535.MFC42U(?,00000002,0000002B,?,?,?,00000000), ref: 01030DC7
#4197.MFC42U(?,00000002,0000002B,?,?,?,00000000), ref: 01030DD3
#2910.MFC42U(00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030DDC
#538.MFC42U(00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E02
#535.MFC42U(-00000007,00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E20
#2755.MFC42U(0000005C,00000002,010014DC,-00000007,00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E40
#800.MFC42U(00000002,010014DC,-00000007,00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E6E
#800.MFC42U(00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E81
#800.MFC42U(00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E8D
#800.MFC42U(00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030E99
#800.MFC42U(00000002,?,0000005C,00000002,010014DC,-00000007,00000000,01001510,00000000,?,00000002,0000002B,?,?,?,00000000), ref: 01030EB8

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#535$#4197$#2755#2910#538H_prolog
String ID:
API String ID: 3790814338-0
Opcode ID: 4ed7cf967fe4ebd7daa35a5425bdf01ebd30325d026db96cd7a5ef546c7fca1d
Instruction ID: 714cd7d19e1f3140a49083efcfdd90fc4828fbe65f3ce8015126f2fe8bc38e0f
Opcode Fuzzy Hash: 4ed7cf967fe4ebd7daa35a5425bdf01ebd30325d026db96cd7a5ef546c7fca1d
Instruction Fuzzy Hash: 4341A63550014ADECB05EBE8C990AEFF7BCAFA4314F504169E4D6A3181DB709B49C7A1

Function 010358F9 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010358FE
#2755.MFC42U(?,00000000,010334DE,?,/separator,00000004,?,?,0000003D,00000000,00000000,/noexpandenvironmentsymbols,00000004,00000000,00000000,/expandenvironmentsymbols), ref: 0103590A
#4124.MFC42U(?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?,0000003D,00000000,00000000,/noexpandenvironmentsymbols,00000004), ref: 01035929
#858.MFC42U(00000000,?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?,0000003D,00000000,00000000,/noexpandenvironmentsymbols), ref: 01035938
#800.MFC42U(00000000,?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?,0000003D,00000000,00000000,/noexpandenvironmentsymbols), ref: 01035944
#4272.MFC42U(00000001,00000001,00000000,?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?,0000003D,00000000), ref: 01035952
#858.MFC42U(00000000,00000001,00000001,00000000,?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?,0000003D), ref: 01035962
#800.MFC42U(00000000,00000001,00000001,00000000,?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?,0000003D), ref: 0103596E
#2910.MFC42U(00000000,00000000,00000001,00000001,00000000,?,-00000001,/separator,?,00000000,010334DE,?,/separator,00000004,?,?), ref: 01035977
wcslen.MSVCRT ref: 0103597D

Strings

/separator, xrefs: 01035920

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800#858$#2755#2910#4124#4272H_prologwcslen
String ID: /separator
API String ID: 2154691547-740813069
Opcode ID: 82c5ca2b5f25696b0a8296983c592367ef51211a2b0c2776392b9aee266abeb2
Instruction ID: f19888b21cbb5f6a10015dc102e489d0ea2a185652382af558033584d1552068
Opcode Fuzzy Hash: 82c5ca2b5f25696b0a8296983c592367ef51211a2b0c2776392b9aee266abeb2
Instruction Fuzzy Hash: 2A11AF7250010AAFCB15EF64DC84AEE7B6DEFD9360F104615F9A2D70D0DB349A52CBA0

Function 010231DA Relevance: 18.1, APIs: 12, Instructions: 83registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 010231DF
#535.MFC42U(00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000,010014DC), ref: 010231F0
#925.MFC42U(80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000,010014DC), ref: 01023206
#940.MFC42U(00000000,80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000,010014DC), ref: 01023213
#800.MFC42U(00000000,80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000,010014DC), ref: 0102321E
#4199.MFC42U(00000000,80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000,010014DC), ref: 01023226
#540.MFC42U(00000000,80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000,010014DC), ref: 01023257
#858.MFC42U(0000001F,00000000,80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000,0000001F,?,00000000), ref: 01023267
#2910.MFC42U(00000000,0000001F,00000000,0000001F,00000000,80000001,80000001,01001514,00000000,0000001F,010014DC,01001514,?,00000000,0000001F,00000000), ref: 0102327A
RegConnectRegistryW.ADVAPI32(00000000,00000000,0000001F), ref: 01023280
#800.MFC42U(?), ref: 010232B5
#800.MFC42U(?), ref: 010232C1

Part of subcall function 0101D5B3: wcscmp.MSVCRT ref: 0101D5BF

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#2910#4199#535#540#858#925#940ConnectH_prologRegistrywcscmp
String ID:
API String ID: 1952506896-0
Opcode ID: eb1c0f5a8791b4b330a4ca3508cc1813dca51a5c99c87598dba46dc5f2eb11f2
Instruction ID: 0762d32595a3036b811d0c24c89b4e503e451022e8515cf4661c48299a20f81b
Opcode Fuzzy Hash: eb1c0f5a8791b4b330a4ca3508cc1813dca51a5c99c87598dba46dc5f2eb11f2
Instruction Fuzzy Hash: 1431A07180025BEFCF11EFA4C9809EEBBB9FFA9304F404459E492A7151DB399B09CB61

Function 010357E8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z.MSVCP60(Type the password for user ,01001510,010193C8,00000000,00000000,00000002,?,01039567,?,00000000,00000000,00000063,00000000,00000000,00000000,00000000), ref: 0103581C
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z.MSVCP60(00000000,?,00000000,00000000,00000063,00000000,00000000,00000000,00000000,00000000,00000001,0000005C,00000000,00000000,00000001,0000003D), ref: 01035821
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z.MSVCP60(00000000), ref: 01035826
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ.MSVCP60 ref: 01035830
_getch.MSVCRT ref: 01035842
_getch.MSVCRT ref: 0103586F
??6ostream@@QAEAAV0@PBX@Z.MSVCIRT(0100ADA8), ref: 01035886

Part of subcall function 0103CC63: SetConsoleActiveScreenBuffer.KERNELBASE(?,0103BA91,00000001,00000001), ref: 0103CC6B

wprintf.MSVCRT ref: 010358B0
ExitProcess.KERNEL32 ref: 010358B9

Strings

Type the password for user , xrefs: 01035811

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: U?$char_traits@$??6std@@G@std@@@0@V10@V?$basic_ostream@$_getch$??6ostream@@?flush@?$basic_ostream@ActiveBufferConsoleExitG@std@@@std@@ProcessScreenV12@wprintf
String ID: Type the password for user
API String ID: 850719922-2504776692
Opcode ID: 6fddccea0128d1129b7d8ca1ba17c76eae221caf5de227e8c73757fa9b4903f8
Instruction ID: b8073cce75ff17edacd76faf6e5a925bf79e50bf883befeac22b385bb5cbe4ce
Opcode Fuzzy Hash: 6fddccea0128d1129b7d8ca1ba17c76eae221caf5de227e8c73757fa9b4903f8
Instruction Fuzzy Hash: DF21E736500300DBE7266F99EC846693BD5FFC4392F14441EF6C2A7194EB7AD440CB55

Function 0102E697 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0102E69C
#535.MFC42U(00000002,00000001,00000002,00000001), ref: 0102E6B8
#4197.MFC42U(00000002,00000001,00000002,00000001), ref: 0102E6C5
#2910.MFC42U(00000000,s-1-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu,?,?,?,?,?,?,?,?,?,00000002,00000001,00000002,00000001), ref: 0102E713
swscanf.MSVCRT ref: 0102E719
InitializeSid.ADVAPI32(?,?,?), ref: 0102E759
GetSidSubAuthority.ADVAPI32(?,00000000,?,?,?), ref: 0102E76C
#800.MFC42U(?,?,?), ref: 0102E787

Strings

s-1-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu, xrefs: 0102E707

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910#4197#535#800AuthorityH_prologInitializeswscanf
String ID: s-1-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu-%lu
API String ID: 670854419-4041171811
Opcode ID: a567a607ecdc4e1e0844a268d52f680bc30044b70d75329a9e3286d6a3fdb510
Instruction ID: 448222addfae4d44e5fdcc9c22e930063297e4328f8ac71bf2c678c47505fdca
Opcode Fuzzy Hash: a567a607ecdc4e1e0844a268d52f680bc30044b70d75329a9e3286d6a3fdb510
Instruction Fuzzy Hash: 4B3106B6D01249AFCB05DFE8D9C08EEFBBDBF58200F50056AE542F3251DA349A45CBA0

Function 010331FD Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01033202
#538.MFC42U(__cachefileonly__,00000001,?,/separator,00000000,00000004,?,010338DA,00000000,00000000,0000003D), ref: 01033289

Part of subcall function 0102CDBF: __EH_prolog.LIBCMT ref: 0102CDC4
Part of subcall function 0102CDBF: #540.MFC42U(010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE06
Part of subcall function 0102CDBF: #2910.MFC42U(00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE19
Part of subcall function 0102CDBF: #535.MFC42U(?,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE32
Part of subcall function 0102CDBF: #800.MFC42U(00000000,010014DC,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE85

Part of subcall function 0101D5F3: wcscmp.MSVCRT ref: 0101D5FD

#800.MFC42U(00000000,010014DC,00000001,00000000,__cachefileonly__,00000001,?,/separator,00000000,00000004,?,010338DA,00000000,00000000,0000003D), ref: 010332AB
#800.MFC42U(00000000,010014DC,00000001,00000000,__cachefileonly__,00000001,?,/separator,00000000,00000004,?,010338DA,00000000,00000000,0000003D), ref: 010332B7

Strings

--- DEBUG SidFactory::ParseMap OffLine cache mode only = , xrefs: 010332D3
__cachefileonly__, xrefs: 01033281
/separator, xrefs: 01033211
--- DEBUG SidFactory::ParseMapOffLine called = , xrefs: 01033228
--- DEBUG SidFactory::ParseMapOffLine failed = , xrefs: 01033261

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$H_prolog$#2910#535#538#540wcscmp
String ID: --- DEBUG SidFactory::ParseMap OffLine cache mode only = $--- DEBUG SidFactory::ParseMapOffLine called = $--- DEBUG SidFactory::ParseMapOffLine failed = $/separator$__cachefileonly__
API String ID: 2801798275-2112690812
Opcode ID: 06973b09e0658937e6bb199966568d3a9197f268382970007f4582abff6ad514
Instruction ID: 83a011bd96f774414fc851cd4575ce38b8e01b33bb413b8864bf0c637d3109ac
Opcode Fuzzy Hash: 06973b09e0658937e6bb199966568d3a9197f268382970007f4582abff6ad514
Instruction Fuzzy Hash: 0A319074600204EFEB55DFA4D8C8B99B7A9FF89311F1080A9F882CB295DB78D941CB50

Function 0102CDBF Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0102CDC4
#540.MFC42U(010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE06
#2910.MFC42U(00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE19
#535.MFC42U(?,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE32
#538.MFC42U(010014DC,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE4E
#535.MFC42U(00000000,010014DC,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE62
#800.MFC42U(00000000,010014DC,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE7A
#800.MFC42U(00000000,010014DC,00000000,00000000,?,010014DC,?,?,?,?,0102FD4F,?,?,?), ref: 0102CE85

Strings

--- DEBUG MapAcc::Get searching = , xrefs: 0102CDE5

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #535#800$#2910#538#540H_prolog
String ID: --- DEBUG MapAcc::Get searching =
API String ID: 4166726754-473342722
Opcode ID: ce2088cfb6b57447d9b427d8a7fc1dca6602ff02be6b46b7e6fb6455c9e8bdba
Instruction ID: 831996c239bc61216b6c7266ad8e1f4242b3ff42feb048e42aa4e1267a205809
Opcode Fuzzy Hash: ce2088cfb6b57447d9b427d8a7fc1dca6602ff02be6b46b7e6fb6455c9e8bdba
Instruction Fuzzy Hash: D821917490025AEFEF04EFA4C5849EEBB78FF54714F108259F495AB290CBB49A05CB90

Function 01032603 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 41COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 01032684

Strings

CTRL_LOGOFF_EVENT, xrefs: 0103262F
received. SubInAcl is stopping ..., xrefs: 01032658
Signal , xrefs: 01032646
CTRL_SHUTDOWN_EVENT, xrefs: 01032639
CTRL_CLOSE_EVENT, xrefs: 01032625
CTRL_BREAK_EVENT, xrefs: 0103261B
CTRL_C_EVENT, xrefs: 01032611

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: ExitProcess
String ID: received. SubInAcl is stopping ...$CTRL_BREAK_EVENT$CTRL_CLOSE_EVENT$CTRL_C_EVENT$CTRL_LOGOFF_EVENT$CTRL_SHUTDOWN_EVENT$Signal
API String ID: 621844428-4291234986
Opcode ID: 4207829b7efa17a73d394cc3aa9cf52c37a46e53ea597742ea656bf0dd42ac24
Instruction ID: c6882f966c738648c2add9872f519b7e2e9bd9f6381ac4f302dd9a0fa2f92cdc
Opcode Fuzzy Hash: 4207829b7efa17a73d394cc3aa9cf52c37a46e53ea597742ea656bf0dd42ac24
Instruction Fuzzy Hash: E6016D34F00314CFEA669B68C498A2972A9BFC9211F5644AAE8C6DF291DA74CC8187D1

Function 0102F44E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

#2910.MFC42U(00000000,?,?,?,?,?,0102F8F5,?,?,010014DC,010014DC,?), ref: 0102F464
#2910.MFC42U(00000000,?,00000000,00000000,?,?,?,?,?,0102F8F5,?,?,010014DC,010014DC,?), ref: 0102F4D7
#823.MFC42U(0000001C,?,00000000,00000000,?,?,?,?,?,0102F8F5,?,?,010014DC,010014DC,?), ref: 0102F4EF
#2910.MFC42U(00000000,?,00000000,00000000,?,?,?,?,?,0102F8F5,?,?,010014DC,010014DC,?), ref: 0102F536

Strings

--- DEBUG SidFactory::GetServerList creating a new cache list for = , xrefs: 0102F4C3
--- DEBUG SidFactory::GetServerList creating list = = , xrefs: 0102F519
--- DEBUG SidFactory::GetServerList using existing list = = , xrefs: 0102F486

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910$#823
String ID: --- DEBUG SidFactory::GetServerList creating a new cache list for = $--- DEBUG SidFactory::GetServerList creating list = = $--- DEBUG SidFactory::GetServerList using existing list = =
API String ID: 701878711-3693111594
Opcode ID: d1f899d1d286a9068438a87aecf41e61ca1f6a9e8f49843b1dbe4beaf24c93ca
Instruction ID: ce6837fc543f014e3e1132a56bd3c67976e0ac3dc1242b0f2a0f523466997834
Opcode Fuzzy Hash: d1f899d1d286a9068438a87aecf41e61ca1f6a9e8f49843b1dbe4beaf24c93ca
Instruction Fuzzy Hash: 49313C75700211EFEB49DFA4D898E9D77B9BF88741F1040A9F942CB391DA74E941CB60

Function 0101C9A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0101C9C6
OpenThreadToken.ADVAPI32(00000000), ref: 0101C9CD
GetCurrentProcess.KERNEL32(000200E8,?), ref: 0101C9D9
OpenProcessToken.ADVAPI32(00000000), ref: 0101C9E0
GetLastError.KERNEL32(Failed to open token :), ref: 0101C9EF

Part of subcall function 0101C94A: __EH_prolog.LIBCMT ref: 0101C94F
Part of subcall function 0101C94A: #540.MFC42U(?,?,0101C9FE,00000000), ref: 0101C967

_CxxThrowException.MSVCRT(?,010414A0), ref: 0101CA07

Strings

Failed to open token :, xrefs: 0101C9EA

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken$#540ErrorExceptionH_prologLastThrow
String ID: Failed to open token :
API String ID: 4051913853-2916064370
Opcode ID: b2c12ae1f3b99604ec212e9eaa9b6d802c35f477963b8e9bb201722e2d40229b
Instruction ID: 05a7e664013c0eb7b7b83520c2125186f4459ecd96f737a296ace3075d047675
Opcode Fuzzy Hash: b2c12ae1f3b99604ec212e9eaa9b6d802c35f477963b8e9bb201722e2d40229b
Instruction Fuzzy Hash: 81013172A00200ABD725EFAAED48DDB7BECAF59755B00842EF5DAD3104DA78D5008B60

Function 0103D271 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0103D276
#538.MFC42U(Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D288
#922.MFC42U(?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D299
#858.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2A6
#800.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2B2
#800.MFC42U(00000000,?,00000000,00000002,Last Syntax Error:,00000002,?,?,0103C8C1,?), ref: 0103D2BE

Part of subcall function 0103CC77: GetTickCount.KERNEL32 ref: 0103CC83
Part of subcall function 0103CC77: SetConsoleActiveScreenBuffer.KERNEL32(?), ref: 0103CCA0

Part of subcall function 0103CF3F: swprintf.MSVCRT(?,%8d,00000002,?,00000001,01001510,00000000,?,00000000,/playfile,00000004,00000000), ref: 0103CF7B
Part of subcall function 0103CF3F: swprintf.MSVCRT(?,%8d,?), ref: 0103CFAC
Part of subcall function 0103CF3F: swprintf.MSVCRT(?,%8d,000000FF,?,00000001), ref: 0103D021

Strings

Last Syntax Error:, xrefs: 0103D280

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: swprintf$#800$#538#858#922ActiveBufferConsoleCountH_prologScreenTick
String ID: Last Syntax Error:
API String ID: 2708531792-206228082
Opcode ID: 0173879657cfabf589ce05755734be5f508d53c396643800c19d4819c233571f
Instruction ID: 035c19eca2fcf84adb68bdaca4e7eee0e2507e51dabe59b8ce13bef191cd1cbf
Opcode Fuzzy Hash: 0173879657cfabf589ce05755734be5f508d53c396643800c19d4819c233571f
Instruction Fuzzy Hash: B501AD7080064AEEEB25EBA4C944BEEB7BDAFB4311F10465DE092621C1DB749B08CB61

Function 0101CF2C Relevance: 12.0, APIs: 8, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0101CF31
#825.MFC42U(?), ref: 0101CF4C
#800.MFC42U ref: 0101CF58
#800.MFC42U ref: 0101CF67
#800.MFC42U ref: 0101CF85
#800.MFC42U ref: 0101CF94
#800.MFC42U ref: 0101CFA0
#800.MFC42U ref: 0101CFAB

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$#825H_prolog
String ID:
API String ID: 1663261258-0
Opcode ID: b0eb468430c7327377dd404da8026f55562b795a5a6f60b3d043bb5f16659c83
Instruction ID: bed9291f9235c8aab6ba138d819040922c6ba00b462dafb9f6ad3424e72e28f9
Opcode Fuzzy Hash: b0eb468430c7327377dd404da8026f55562b795a5a6f60b3d043bb5f16659c83
Instruction Fuzzy Hash: 58015E34401785DEE715EBB8C1947DDBBA9AF68304F40468DE0DA63280CBB46B08C761

Function 01030BD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 01030BF6
IsValidSid.ADVAPI32(?), ref: 01030D12
IsValidSid.ADVAPI32(?), ref: 01030D66

Strings

Unable to find SID for , xrefs: 01030CAB
--- DEBUG GetDomainPSid2 IsValidSid(Psid2) = , xrefs: 01030D54
--- DEBUG GetDomainPSid2 IsValidSid(Psid1) = , xrefs: 01030D02

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: Valid$wcscmp
String ID: --- DEBUG GetDomainPSid2 IsValidSid(Psid1) = $--- DEBUG GetDomainPSid2 IsValidSid(Psid2) = $Unable to find SID for
API String ID: 377044621-4254668258
Opcode ID: cf4f3f761dc07a7e071591bc1cf401de6889f54edc58b574f3d10047c617d899
Instruction ID: 951378500d3e1b31105236783435d882ea2b8deed87de854e5feb906c18930f5
Opcode Fuzzy Hash: cf4f3f761dc07a7e071591bc1cf401de6889f54edc58b574f3d10047c617d899
Instruction Fuzzy Hash: B6517974A0131AEFDB62CFA8D88899E7BB9FF88740F104469F8919B254C775D891CF90

Function 0101CCD2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_wfopen.MSVCRT ref: 0101CCDE
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z.MSVCP60(File Format Error), ref: 0101CD03
SetLastError.KERNEL32(000003EE), ref: 0101CD10
#861.MFC42U(?), ref: 0101CD21
_setmode.MSVCRT ref: 0101CD31

Strings

File Format Error, xrefs: 0101CCF8

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #861??6std@@ErrorG@std@@@0@LastU?$char_traits@V10@V?$basic_ostream@_setmode_wfopen
String ID: File Format Error
API String ID: 4085901116-698866040
Opcode ID: f2a8e4e5bfcc910384d55b5d9227c8be5635946011be624e2bcb0e92c942b70b
Instruction ID: a319122382f0c22e18e849109024174878b4cba5846b61d0d600157121859ebf
Opcode Fuzzy Hash: f2a8e4e5bfcc910384d55b5d9227c8be5635946011be624e2bcb0e92c942b70b
Instruction Fuzzy Hash: FE017C32144701DFE726AF60E905A4ABBF0FB08320F10891DF4C6C65A4EB39E850CB04

Function 0101CC0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

fread.MSVCRT ref: 0101CC43
fwrite.MSVCRT ref: 0101CC5A

Strings

Unicode big endian file text format is not supported.Please use notepad to convert it (ANSI and Unicode formats are supported), xrefs: 0101CC8E

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: freadfwrite
String ID: Unicode big endian file text format is not supported.Please use notepad to convert it (ANSI and Unicode formats are supported)
API String ID: 837997839-1918953666
Opcode ID: cef88eb4fcd12d612ae8e4c06c1e32c6061e2be32e4a2617126e9774e6cc0064
Instruction ID: f75b6b6febcafd79fdebe6d28788532cace25d497b86565ea755f9c20955bdfa
Opcode Fuzzy Hash: cef88eb4fcd12d612ae8e4c06c1e32c6061e2be32e4a2617126e9774e6cc0064
Instruction Fuzzy Hash: D321F27158428CBEEB329BAC8A559AF7FF9DB06264B5446E9E0D2D224AD135DD008328

Function 0102E62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?,00000000,00000002,00000000,?,-00000012,?,00000001,0000003D,00000000,00000000,/setowner=,00000004,00000000,?,00000000), ref: 0102E645
CopySid.ADVAPI32(00000032,00000002,?), ref: 0102E655
GetLastError.KERNEL32(Error CopySid ), ref: 0102E664

Part of subcall function 0101C94A: __EH_prolog.LIBCMT ref: 0101C94F
Part of subcall function 0101C94A: #540.MFC42U(?,?,0101C9FE,00000000), ref: 0101C967

_CxxThrowException.MSVCRT(?,010414A0), ref: 0102E67C

Strings

Error CopySid , xrefs: 0102E65F

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #540CopyErrorExceptionH_prologLastThrowValid
String ID: Error CopySid
API String ID: 3092688155-877931506
Opcode ID: 19e0bca595bc06dbee59b0bb2a227ef17274e60b729aa27388d1ef91bb7aa2cf
Instruction ID: 6b55c937f8a52c2719c7b4527503ce3eecb0dcf503a24f22502e57979f0fed25
Opcode Fuzzy Hash: 19e0bca595bc06dbee59b0bb2a227ef17274e60b729aa27388d1ef91bb7aa2cf
Instruction Fuzzy Hash: F6F02B326401147BEB11A7A9EC09FCB7B9C9F48A50F008135F285D6084EDB0C545C2A1

Function 0103DE79 Relevance: 7.5, APIs: 5, Instructions: 35timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0103DE94
GetCurrentProcessId.KERNEL32 ref: 0103DEA0
GetCurrentThreadId.KERNEL32 ref: 0103DEA8
GetTickCount.KERNEL32 ref: 0103DEB0
QueryPerformanceCounter.KERNEL32(?), ref: 0103DEBC

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 2b17c8b93b4609e7913efc2e307c24b36cfba2d57188e4307f4f3112f818866c
Instruction ID: 98c94bfa8a57458ae85fd220cca61a0cc5e3f84f7947e70c70d9020366744c8f
Opcode Fuzzy Hash: 2b17c8b93b4609e7913efc2e307c24b36cfba2d57188e4307f4f3112f818866c
Instruction Fuzzy Hash: CFF0FF75D001149FCB31EBF9E9485DABBFDFB0C344B8205A5E881E7104EA36E9008B90

Function 01032F2F Relevance: 7.5, APIs: 5, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01032F34
#800.MFC42U ref: 01032F4A
#800.MFC42U ref: 01032F56
#800.MFC42U ref: 01032F62
#800.MFC42U ref: 01032F6D

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$H_prolog
String ID:
API String ID: 948933410-0
Opcode ID: 0ada0ff1e3ee57376ffeb2536054ecffc763249b6c2516b18a1b4d3d273537c6
Instruction ID: 6d8bcdb5e1fdc45a10eddb560a03f579a8e6d2c276a3fa49ec6c34c6c46595aa
Opcode Fuzzy Hash: 0ada0ff1e3ee57376ffeb2536054ecffc763249b6c2516b18a1b4d3d273537c6
Instruction Fuzzy Hash: 33F06D70800695EEC718EBE8D1847DDFBB9EFA8310F40868DA4E6636C4CBB45B04C791

Function 01032EE1 Relevance: 7.5, APIs: 5, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01032EE6
#540.MFC42U ref: 01032EF2
#540.MFC42U ref: 01032EFE
#540.MFC42U ref: 01032F0A
#540.MFC42U ref: 01032F16

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #540$H_prolog
String ID:
API String ID: 385474894-0
Opcode ID: af83865b372731863ec9a6c0ad19e75e8a97d279ccc91f5ae1da6314a1e12a5f
Instruction ID: b2f17a8ac7ff21f53f46c4f2f919012626f6f2e14acdf4c854766d878397d433
Opcode Fuzzy Hash: af83865b372731863ec9a6c0ad19e75e8a97d279ccc91f5ae1da6314a1e12a5f
Instruction Fuzzy Hash: 5CE06D309006559EC704FBE4C084BDDF7A8EFA4200F40845DA496A3690CBB49B04C7A1

Function 0103522A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(CLUSAPI.DLL,01036629,00000000,00000000,/clustershare,00000004,00000000,00000000,+samobject,00000004,00000000,00000000,/samobject,00000004,00000000,00000000), ref: 01035238
FreeLibrary.KERNEL32(00000000), ref: 01035271

Strings

CLUSAPI.DLL, xrefs: 01035233
ERROR: ClusApi.dll not installed on the system.SubInAcl will not be able to work with cluster resources, xrefs: 01035250

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: Library$FreeLoad
String ID: CLUSAPI.DLL$ERROR: ClusApi.dll not installed on the system.SubInAcl will not be able to work with cluster resources
API String ID: 534179979-2137802379
Opcode ID: 87909922538a66e366b5fa74236eac43bef312618e037b1e4e42180b493ecfc1
Instruction ID: f1a9c96b63fccb6b727646e12cdbf966b0145bf4dcdf7cfbf6379b58de036bbc
Opcode Fuzzy Hash: 87909922538a66e366b5fa74236eac43bef312618e037b1e4e42180b493ecfc1
Instruction Fuzzy Hash: 5BF0C978641301DFC76DDF75DA89A1536A4AB4A74AB0840A8F0D2CA16AE77BD440CB51

Function 01022F77 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

#825.MFC42U(00000000,00000000,00000000,00000000,00000000,01046E58,?,010230C4,00000001,000000FF,00000000,010014DC,010232A3,?), ref: 01022FA5
#823.MFC42U(00000000,00000000,00000000,01046E58,?,010230C4,00000001,000000FF,00000000,010014DC,010232A3,?), ref: 01022FC8

Part of subcall function 01022E90: __EH_prolog.LIBCMT ref: 01022E95
Part of subcall function 01022E90: #540.MFC42U(00000000,00000000,01023087,00000000,00000000,01046E58,00000000,00000000), ref: 01022EBE

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #540#823#825H_prolog
String ID:
API String ID: 2095685955-0
Opcode ID: def2af2a9af6f831c126423e2a7adca48276ad740311eae32a9a573452c4cc85
Instruction ID: 3e2ed7b1f2eeeb22b134dbfd77c78c256f276eb06c92657376a7ce0f3db496c5
Opcode Fuzzy Hash: def2af2a9af6f831c126423e2a7adca48276ad740311eae32a9a573452c4cc85
Instruction Fuzzy Hash: 0E41D971600124DBCF14DF68C8D4A9AB7A9FF58760B14C19AF989DF245C738DD40CBA0

Function 0101CE0F Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

#2440.MFC42U(0000000C,00000001,00000000,00000002,00000000,?,0103A566,0000003D,00000000,00000000,00000001,00000000,00000000,00000000,0000003D,00000000), ref: 0101CE32
#2440.MFC42U(00000008,00000001,0000000C,00000001,00000000,00000002,00000000,?,0103A566,0000003D,00000000,00000000,00000001,00000000,00000000,00000000), ref: 0101CE3D
#825.MFC42U(?,00000000,?,0103A566,0000003D,00000000,00000000,00000001,00000000,00000000,00000000,0000003D,00000000,00000000,00000001,0000003D), ref: 0101CE53
#2836.MFC42U(00000000,?,0103A566,0000003D,00000000,00000000,00000001,00000000,00000000,00000000,0000003D,00000000,00000000,00000001,0000003D,00000000), ref: 0101CE65

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2440$#2836#825
String ID:
API String ID: 3528173745-0
Opcode ID: 208d2fcb31b617955c355413d7d45d7b6de466906304fcc8e804ec364d31e1f7
Instruction ID: 5b8cc35b14cf1382165abea5724f77d433850903c00d108a6e346719e726ec6f
Opcode Fuzzy Hash: 208d2fcb31b617955c355413d7d45d7b6de466906304fcc8e804ec364d31e1f7
Instruction Fuzzy Hash: 3B018C76900B099FD234DF99D680A97F7EDFB80B107108A5EE2DA87900CB75F880CB90

Function 01022CC8 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01022CCD
#540.MFC42U ref: 01022CD9

Part of subcall function 01022D4C: #538.MFC42U(010014DC,00000000,?,0102EC8A,00000000,?,0102EECE,00000008,00000001,010014DC,?,0102EFB4,00000000,?,010014DC,00000000), ref: 01022D6D

Part of subcall function 01022D7C: __EH_prolog.LIBCMT ref: 01022D81
Part of subcall function 01022D7C: #540.MFC42U(?,?,?,?,01022D1A,00000000), ref: 01022DBE

#540.MFC42U(00000000), ref: 01022D24
#540.MFC42U(00000000), ref: 01022D33

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #540$H_prolog$#538
String ID:
API String ID: 2443229473-0
Opcode ID: afd9630e0346f6546e6d7b74423216f73bc7850241e418594121188673b95373
Instruction ID: e1042c1bdb378dd5b4014b9dc847e0cff3a9fd6e9fe565d7f7182796cc05e3e1
Opcode Fuzzy Hash: afd9630e0346f6546e6d7b74423216f73bc7850241e418594121188673b95373
Instruction Fuzzy Hash: 6A012830801A96DEE715FBA4C254BEDBBB8AF74205F40488CD096632D1CBB42608C7A2

Function 0101E41F Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0101E424
CloseClusterResource.CLUSAPI(?,?,?,01034F4D,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 0101E458
CloseCluster.CLUSAPI(?,?,?,01034F4D,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 0101E468
#800.MFC42U(?,?,01034F4D,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0101E47D

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: CloseCluster$#800H_prologResource
String ID:
API String ID: 3842268394-0
Opcode ID: 762dc7a7f42047ba7918209a63a823b6635ef1a7022217b77fb8effbf0feb31d
Instruction ID: 7af1890f2a79ba791b8e7fb461c1cc809c941770b99a12977469ae605288bce2
Opcode Fuzzy Hash: 762dc7a7f42047ba7918209a63a823b6635ef1a7022217b77fb8effbf0feb31d
Instruction Fuzzy Hash: 57F06270641706DBE765EFB8D54C7DABBE9BF64710F008A4DA5F693280CB749500CB50

Function 010313FD Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 01031402
CloseHandle.KERNEL32(?,?,?,01034F2F,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?), ref: 01031430
#800.MFC42U(?,?,01034F2F,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0103143C
#800.MFC42U(?,?,01034F2F,01001510,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000000), ref: 01031455

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800$CloseH_prologHandle
String ID:
API String ID: 2902412255-0
Opcode ID: 211ac2aa76306373d74f1e41e53db02b1e0ac730ba8a968ece303f552cda661e
Instruction ID: 050585ed2b21a25960136ca2bcfe6c6fd3c486ea594508ac16b2aee278e5eaf3
Opcode Fuzzy Hash: 211ac2aa76306373d74f1e41e53db02b1e0ac730ba8a968ece303f552cda661e
Instruction Fuzzy Hash: C4F01D70A40796DED72ADF68C4547DEBBF8BF58314F00465DE4E693280CBB45A44CB40

Function 0102F553 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0102F558

Part of subcall function 0102F44E: #2910.MFC42U(00000000,?,?,?,?,?,0102F8F5,?,?,010014DC,010014DC,?), ref: 0102F464

#800.MFC42U(?,?,?,?,0102FE92,?,?,?,?,010014DC,?,?,?,010014DC,00000001,00000002), ref: 0102F5B9

Strings

--- DEBUG SidFactory::AddHead list is = , xrefs: 0102F57F

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #2910#800H_prolog
String ID: --- DEBUG SidFactory::AddHead list is =
API String ID: 1177636673-2532537097
Opcode ID: de2460606023f24ef099915507b40e09bcacabb49a91b27f4195e831fd126a5c
Instruction ID: 8cd8cbfb3d8330c8cff8a136cfdc5f98d60d682285e29ea3a67247b272d5558a
Opcode Fuzzy Hash: de2460606023f24ef099915507b40e09bcacabb49a91b27f4195e831fd126a5c
Instruction Fuzzy Hash: 1C01D171A00216EFDB08EFA4C848BED7775FF88351F008258F4929B290DB74EA01CB91

Function 01032565 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#535.MFC42U(010532B4,010532B8,?,01032BD6,?,00000000,?,00000000,01001510,?,00000000,00000000,?,00000000,?,/alternatesamserver), ref: 0103257B
#538.MFC42U(Console,010532B8,?,01032BD6,?,00000000,?,00000000,01001510,?,00000000,00000000,?,00000000,?,/alternatesamserver), ref: 0103258A

Strings

Console, xrefs: 01032585

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #535#538
String ID: Console
API String ID: 1340180697-4190041642
Opcode ID: 3a66547c84d0a3a2425ab3acd73ebe502561039f79afd760bc5be023c9de4362
Instruction ID: 7d865edd33381d3b49cccba0936388b95c58d49df84a25101d288e9fe8e48e74
Opcode Fuzzy Hash: 3a66547c84d0a3a2425ab3acd73ebe502561039f79afd760bc5be023c9de4362
Instruction Fuzzy Hash: 55D0127120410EEBE704DB54C451FED779C9BA035CF40811CA54B5B180C6B9DA85C795

Function 0101CA19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0101CA1E

Part of subcall function 0101C8D5: #861.MFC42U(010014DC,?,0101C908,000200E8,?,0105328C,0101C97C,?,?,?,?,0101C9FE), ref: 0101C8E1
Part of subcall function 0101C8D5: LocalFree.KERNEL32(00000000,010014DC,?,0101C908,000200E8,?,0105328C,0101C97C,?,?,?,?,0101C9FE), ref: 0101C8EE

#800.MFC42U( : ,?,0103B795), ref: 0101CA3A

Strings

: , xrefs: 0101CA24

Memory Dump Source

Source File: 00000031.00000002.2808735091.0000000001001000.00000020.00000001.01000000.00000037.sdmp, Offset: 01000000, based on PE: true

Associated: 00000031.00000002.2808713291.0000000001000000.00000002.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001046000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2808774672.0000000001053000.00000004.00000001.01000000.00000037.sdmpDownload File
Associated: 00000031.00000002.2809566433.0000000001054000.00000002.00000001.01000000.00000037.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_1000000_subinacl.jbxd

Similarity

API ID: #800#861FreeH_prologLocal
String ID: :
API String ID: 1022488853-3653984579
Opcode ID: 24c085f7b34f1d2fcb47e7e9f7558475d9882d1788f02071bca321dac20d16dd
Instruction ID: a84505c1dc44ade0bd75c57e71be1a1ade6371b6f9efa46de8769f35129e339c
Opcode Fuzzy Hash: 24c085f7b34f1d2fcb47e7e9f7558475d9882d1788f02071bca321dac20d16dd
Instruction Fuzzy Hash: 26D01771850626EBD718EB98C9447EDB7B8FB58331F10839EA0A6A25D0DBB45A01CB50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OqAVRCkQ3T.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll.config (copy)

C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)

C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll.config (copy)

C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)

Windows Analysis Report
OqAVRCkQ3T.exe

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre